devops-bot-sdk 1.7.43__tar.gz → 1.7.45__tar.gz

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.7.43
+Version: 1.7.45
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.45}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.7.43
+Version: 1.7.45
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.45}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -279,6 +279,7 @@ tests/test_ticket_run_resolve_by_id.py
 tests/test_ticket_schedule_and_agent.py
 tests/test_ticket_speed_fixes.py
 tests/test_tier_flag_parity.py
+tests/test_ui_bruteforce_guard.py
 tests/test_ui_gate.py
 tests/test_ui_lifespan.py
 tests/test_ui_no_native_dialogs.py

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.45}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.7.43
+Version: 1.7.45
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.7.43"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.7.45"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.45}/sdk/firewall.py

@@ -19,10 +19,13 @@ from the *same* list the middleware enforces, so the two layers cannot drift.
     agentos firewall --any --apply# open the port, leaving the allowlist as the gate
     agentos firewall --revoke IP  # print the matching delete rule
 
-``--any`` is also what runs automatically after a self-update
-(``updater._ensure_firewall``), because a pip upgrade replaces code and
-nothing else — a host whose kernel drops the SYNs stays broken across every
-update while reporting a healthy version.
+After a self-update ``updater._ensure_firewall`` runs :func:`ensure_restricted`:
+it adds a per-IP rule for every allowlisted address and REMOVES the open-to-any
+rule. It used to run ``--any``, and that left every VPS with 8765 open to the
+internet: each brute-force/scanner request then reached Python before the
+allowlist refused it, and a flood pinned the panel at 100% CPU. Open-to-any is
+now only kept when the operator chose it — ``AGENTOS_UI_PUBLIC=1`` (public mode
+needs the port reachable) or ``AGENTOS_FIREWALL_OPEN_ANY=1``.
 
 Applying is deliberately opt-in: editing a live firewall is exactly the operation
 that can lock an operator out of their own box, so the default is to print and let
@@ -30,6 +33,7 @@ a human read it first.
 """
 from __future__ import annotations
 
+import ipaddress
 import os
 import platform
 import shutil
@@ -111,10 +115,13 @@ def allow_any_rules(port: int, system: str | None = None) -> list[str]:
       corrected in seconds without root on the box, which is exactly what a
       kernel rule cannot offer.
 
-    So: open the port, keep the decision in the allowlist. Use
-    :func:`allow_rules` instead when the host must not accept a connection from
-    an unlisted address at all (a shared or hostile network), and accept that a
-    backend IP change then needs a root session on every host.
+    That reasoning held for *access* but not for *load*: every request from the
+    internet still costs a Python round-trip before the allowlist refuses it, and
+    a brute-force flood took panels to 100% CPU. So this is no longer the default
+    — :func:`ensure_restricted` is — and is kept for public mode and for an
+    operator who opts in with ``AGENTOS_FIREWALL_OPEN_ANY=1``. A backend IP move
+    is still self-healing: the new IP goes in ``_DEFAULT_ALLOWED_IPS`` and the
+    next self-update adds its rule.
     """
     sysname = (system or _system()).lower()
 
@@ -201,6 +208,17 @@ def ensure_open(port: int | None = None, *, apply: bool = True) -> tuple[bool, s
         who = "Administrator" if sysname == "windows" else "root (sudo)"
         return (False, f"TCP {port} is not open and opening it needs {who}:\n{printable}")
 
+    failed = _apply_rules(rules)
+    if failed:
+        return (False, "could not open TCP %d: %s" % (port, "; ".join(failed)))
+    return (True, f"opened TCP {port} inbound")
+
+
+def _apply_rules(rules: list[str]) -> list[str]:
+    """Run each rule (already privileged, so a printed ``sudo `` is stripped).
+
+    Returns one ``"<cmd>: <reason>"`` per failure — empty means all applied.
+    """
     failed: list[str] = []
     for rule in rules:
         cmd = rule[len("sudo "):] if rule.startswith("sudo ") else rule
@@ -214,9 +232,129 @@ def ensure_open(port: int | None = None, *, apply: bool = True) -> tuple[bool, s
         if proc.returncode != 0:
             tail = (proc.stderr or proc.stdout or "").strip().splitlines()
             failed.append(f"{cmd}: {tail[-1][:120] if tail else f'exit {proc.returncode}'}")
+    return failed
+
+
+def _net(value: str):
+    """``value`` as an ip_network, or None — so ``1.2.3.4`` and ``1.2.3.4/32`` match."""
+    try:
+        return ipaddress.ip_network(value.strip(), strict=False)
+    except ValueError:
+        return None
+
+
+def open_any_opted_in() -> bool:
+    """Has the operator chosen to keep the port open to any source?
+
+    True for ``AGENTOS_UI_PUBLIC=1`` (public mode is unreachable otherwise) or an
+    explicit ``AGENTOS_FIREWALL_OPEN_ANY=1``. Read from the process env or
+    ``~/.agentos/.env``, like every other ``AGENTOS_UI_*`` toggle.
+    """
+    try:
+        from sdk.ui.ip_allowlist import _TRUE, _setting, public_mode
+    except Exception:  # noqa: BLE001 — never fail open on an import hiccup
+        return False
+    return public_mode() or _setting("AGENTOS_FIREWALL_OPEN_ANY").lower() in _TRUE
+
+
+def ensure_restricted(port: int | None = None, *, apply: bool = True,
+                      ips: list[str] | None = None) -> tuple[bool, str]:
+    """Limit ``port`` to the allowlisted IPs. Returns ``(changed, message)``. Never raises.
+
+    Adds a per-IP rule for each allowlisted address that lacks one, THEN removes
+    the open-to-any rule — in that order, and the removal is skipped if any add
+    failed, so the backend never loses its route mid-change. Same contract as
+    :func:`ensure_open` otherwise: unreadable state is never treated as closed,
+    an unprivileged run only returns the commands, and macOS never applies.
+
+    A message that needs the operator to act is multi-line (it carries commands),
+    which is what ``updater._ensure_firewall`` keys on to surface it.
+    """
+    port = ui_port() if port is None else port
+    sysname = _system()
+    if ips is None:
+        try:
+            from sdk.config import get_allowed_ips
+            ips = get_allowed_ips()
+        except Exception:  # noqa: BLE001
+            ips = []
+
+    try:
+        sources = port_sources(port, sysname, collapse=False)
+    except Exception:  # noqa: BLE001 — a status probe must never break an update
+        sources = None
+
+    inactive_note = ""
+    if sysname == "linux" and _ufw_inactive():
+        inactive_note = ("\nNOTE: ufw is INACTIVE, so no rule is enforced and the port is open "
+                         "to everyone.\nEnable it once you have allowed SSH:\n"
+                         "  sudo ufw allow OpenSSH && sudo ufw enable")
+
+    if sources is None:
+        rules = allow_rules(ips, port, sysname) + [revoke_any_rule(port, sysname)]
+        printable = "  " + "\n  ".join(rules)
+        ok, tool = _tool_present()
+        why = tool if not ok else "needs root to read the firewall state"
+        return (False, f"could not read the firewall state ({why}) — to restrict TCP {port} "
+                       f"to the allowlist yourself:\n{printable}")
+
+    have = {n for n in (_net(x) for x in sources) if n is not None}
+    missing = [ip for ip in ips if _net(ip) is not None and _net(ip) not in have]
+    open_any = "Anywhere" in sources
+
+    if not missing and not open_any:
+        return (False, f"TCP {port} is restricted to the allowlist" + inactive_note)
+
+    rules = allow_rules(missing, port, sysname)
+    if open_any:
+        rules.append(revoke_any_rule(port, sysname))
+    printable = "  " + "\n  ".join(rules)
+    what = (f"TCP {port} is open to ANY source" if open_any
+            else f"TCP {port} is missing a rule for: {', '.join(missing)}")
+
+    if not apply or sysname == "darwin":
+        return (False, f"{what}. To restrict it to the allowlist:\n{printable}" + inactive_note)
+    if not _is_privileged():
+        who = "Administrator" if sysname == "windows" else "root (sudo)"
+        return (False, f"{what} and restricting it needs {who}:\n{printable}" + inactive_note)
+
+    failed = _apply_rules(allow_rules(missing, port, sysname))
     if failed:
-        return (False, "could not open TCP %d: %s" % (port, "; ".join(failed)))
-    return (True, f"opened TCP {port} inbound")
+        # The any-rule stays: removing it now could cut the backend off.
+        return (False, f"could not add allowlist rules for TCP {port}: {'; '.join(failed)}"
+                       f"\nThe open-to-any rule was left in place.")
+    if open_any:
+        failed = _apply_rules([revoke_any_rule(port, sysname)])
+        still = port_sources(port, sysname, collapse=False) or set()
+        if failed or "Anywhere" in still:
+            return (bool(missing), f"TCP {port} is still open to any source — a rule the SDK "
+                                   f"did not create allows it. Find and delete it:\n  "
+                                   + ("sudo ufw status numbered" if sysname == "linux" else
+                                      "netsh advfirewall firewall show rule name=all dir=in")
+                                   + inactive_note)
+        return (True, f"restricted TCP {port} to the allowlist ({len(ips)} IP(s))" + inactive_note)
+    return (True, f"added allowlist rule(s) for TCP {port}: {', '.join(missing)}" + inactive_note)
+
+
+def apply_ip(ip: str, *, add: bool = True, port: int | None = None) -> tuple[bool, str]:
+    """Add (or remove) the kernel rule for one runtime-allowlisted ``ip``. Never raises.
+
+    Called by the ``/api/ui/allowlist`` routes so a newly whitelisted IP is not
+    dropped by the host firewall until the next self-update. Applies only when
+    the panel is privileged and the port is not deliberately open to any source;
+    otherwise returns the command for the operator to run.
+    """
+    port = ui_port() if port is None else port
+    sysname = _system()
+    rule = (allow_rules([ip], port, sysname)[0] if add else revoke_rule(ip, port, sysname))
+    if open_any_opted_in():
+        return (False, "port is open to any source by choice — no per-IP rule needed")
+    if sysname not in ("linux", "windows") or not _is_privileged():
+        return (False, f"run on the host to update its firewall:\n  {rule}")
+    failed = _apply_rules([rule])
+    if failed:
+        return (False, f"firewall rule failed: {failed[0]}")
+    return (True, f"firewall rule {'added' if add else 'removed'} for {ip}")
 
 
 def revoke_rule(ip: str, port: int, system: str | None = None) -> str:
@@ -310,7 +448,8 @@ def _parse_netsh(text: str, port: int) -> set[str]:
     return out
 
 
-def port_sources(port: int, system: str | None = None) -> set[str] | None:
+def port_sources(port: int, system: str | None = None, *,
+                 collapse: bool = True) -> set[str] | None:
     """Which sources the HOST firewall currently allows to ``port``.
 
     ``{"Anywhere"}`` means open to the world. **``None`` means the state could not
@@ -322,6 +461,9 @@ def port_sources(port: int, system: str | None = None) -> set[str] | None:
     (`sdk.config.get_allowed_ips`) and the host firewall are separate layers, and
     the interesting question is where they DISAGREE — an IP the app permits but the
     kernel drops looks exactly like a broken backend.
+
+    ``collapse=False`` keeps the per-IP sources alongside ``"Anywhere"`` — what
+    :func:`ensure_restricted` needs to know which IP rules already exist.
     """
     sysname = (system or _system()).lower()
     if sysname == "linux":
@@ -329,17 +471,27 @@ def port_sources(port: int, system: str | None = None) -> set[str] | None:
         if text is None:
             return None
         got = _parse_ufw(text, port)
-        return {"Anywhere"} if "Anywhere" in got else got
+        return {"Anywhere"} if collapse and "Anywhere" in got else got
     if sysname == "windows":
         text = _run(["netsh", "advfirewall", "firewall", "show", "rule",
                      "name=all", "dir=in"], timeout=25.0)
         if text is None:
             return None
         got = _parse_netsh(text, port)
-        return {"Anywhere"} if "Anywhere" in got else got
+        return {"Anywhere"} if collapse and "Anywhere" in got else got
     return None          # macOS pf and anything else: not readable this way
 
 
+def _ufw_inactive() -> bool:
+    """True only when ufw positively reports ``Status: inactive``.
+
+    Then every ufw rule is decoration and the port is open regardless — the
+    "per-IP rules are applied but the flood still arrives" case.
+    """
+    text = _run(["ufw", "status"])
+    return bool(text) and "status: inactive" in text.lower()
+
+
 def _is_privileged() -> bool:
     if _system() == "windows":
         try:
@@ -382,10 +534,9 @@ def cli(argv: list[str]) -> int:
     print(f"Allowed  : {', '.join(ips) if ips else '(none — loopback only)'}")
 
     # `--any` opens the port to every source and leaves the decision to
-    # IPAllowlistMiddleware. This is what the post-update hook uses; see
-    # `allow_any_rules` for why a per-IP kernel rule is the more fragile of the
-    # two. It does NOT need an allowlist to be populated first, so it is checked
-    # before the "nothing to open" bail below.
+    # IPAllowlistMiddleware. NOT the default any more (see `allow_any_rules`):
+    # every internet scanner then reaches Python. It does NOT need an allowlist to
+    # be populated first, so it is checked before the "nothing to open" bail below.
     if "--any" in argv or "--open" in argv:
         current = port_sources(port, sysname)
         if current:
@@ -403,7 +554,10 @@ def cli(argv: list[str]) -> int:
         for r in rules:
             print(f"  {r}")
         print("\nAccess is still gated by the app allowlist above — an unlisted IP is\n"
-              "refused by IPAllowlistMiddleware even with the port open.")
+              "refused by IPAllowlistMiddleware even with the port open.\n"
+              "WARNING: every scanner on the internet can then reach the panel process;\n"
+              "a brute-force flood costs CPU even though it is refused. The next\n"
+              "self-update narrows it back unless AGENTOS_FIREWALL_OPEN_ANY=1 is set.")
         if "--apply" not in argv:
             print("\n(dry run — nothing changed. Re-run with --apply to execute.)")
             return 0
@@ -417,6 +571,9 @@ def cli(argv: list[str]) -> int:
         return 0
 
     rules = allow_rules(ips, port, sysname)
+    if "Anywhere" in (port_sources(port, sysname) or set()):
+        rules.append(revoke_any_rule(port, sysname))
+        print(f"\nTCP {port} is currently open to ANY source — the last rule removes that.")
     print("\nFirewall rules for this host:\n")
     for r in rules:
         print(f"  {r}")
@@ -445,27 +602,9 @@ def cli(argv: list[str]) -> int:
         print(f"\nerror: --apply needs {who}.")
         return 1
 
-    failed = 0
-    print()
-    for r in rules:
-        # The printed form carries `sudo` for humans; we are already privileged.
-        cmd = r[len("sudo "):] if r.startswith("sudo ") else r
-        try:
-            proc = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
-        except Exception as exc:  # noqa: BLE001 — never leave the firewall half-known
-            print(f"  ✗ {cmd}\n      {exc}")
-            failed += 1
-            continue
-        tail = (proc.stdout or proc.stderr or "").strip().splitlines()
-        note = tail[-1][:100] if tail else ""
-        if proc.returncode == 0:
-            print(f"  ✓ {cmd}\n      {note}" if note else f"  ✓ {cmd}")
-        else:
-            print(f"  ✗ {cmd}  (exit {proc.returncode})\n      {note}")
-            failed += 1
-
-    print(f"\n{len(rules) - failed}/{len(rules)} applied.")
-    return 1 if failed else 0
+    changed, msg = ensure_restricted(port, apply=True, ips=ips)
+    print(f"\n{msg}")
+    return 0 if changed or "restricted to the allowlist" in msg else 1
 
 
 if __name__ == "__main__":  # pragma: no cover

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.45}/sdk/help_data/areas.json

@@ -1,12 +1,12 @@
 [
  {
   "area": "Control panel",
-  "changes_30d": 6,
+  "changes_30d": 7,
   "features_30d": 2,
   "fixes_30d": 1,
-  "latest": "security: stop tracking .env (PyPI token) + FAQ: panel/SDK from another machine, Linux & Windows IP commands",
-  "latest_pr": 187,
-  "latest_date": "2026-10-28"
+  "latest": "security: restrict panel port to the allowlist, cheap refusals, auth-failure bans, connection cap",
+  "latest_pr": 188,
+  "latest_date": "2026-10-29"
  },
  {
   "area": "Help",

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.45}/sdk/help_data/releases.json

@@ -1,4 +1,14 @@
 [
+ {
+  "pr": 188,
+  "date": "2026-10-29",
+  "merged_at": "2026-10-29T17:17:14+05:00",
+  "type": "Other",
+  "area": "Control panel",
+  "title": "security: restrict panel port to the allowlist, cheap refusals, auth-failure bans, connection cap",
+  "version": "1.7.45",
+  "url": "https://github.com/consultancy-outfit/DevOpsBot-SDK/pull/188"
+ },
  {
   "pr": 187,
   "date": "2026-10-28",

devops_bot_sdk-1.7.45/sdk/help_data/snapshot.json

@@ -0,0 +1,17 @@
+[
+ {
+  "version": "1.7.45",
+  "commit": "1f30499",
+  "pushed_at": "2026-10-29T17:17:14+05:00",
+  "generated_at": "2026-10-29T12:18:17+00:00",
+  "commands": 58,
+  "commands_invalid": 0,
+  "commands_undocumented": 0,
+  "panel_pages": 11,
+  "tests": 2591,
+  "prs_7d": 29,
+  "prs_30d": 40,
+  "features_30d": 12,
+  "fixes_30d": 18
+ }
+]

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.45}/sdk/ui/api.py

@@ -230,7 +230,9 @@ async def add_to_allowlist(body: AllowlistEntry) -> dict:
     """
     from sdk.config import add_allowed_ip
 
-    return {"added": body.ip, "allowed_ips": add_allowed_ip(body.ip)}
+    allowed = add_allowed_ip(body.ip)
+    return {"added": body.ip, "allowed_ips": allowed,
+            "firewall": await _sync_allowlist(body.ip, add=True)}
 
 
 @router.delete("/allowlist", dependencies=[_auth])
@@ -239,9 +241,32 @@ async def remove_from_allowlist(ip: str = Query(...)) -> dict:
     from sdk.config import remove_allowed_ip, PermanentAllowlistEntry
 
     try:
-        return {"removed": ip, "allowed_ips": remove_allowed_ip(ip)}
+        allowed = remove_allowed_ip(ip)
     except PermanentAllowlistEntry as exc:
         raise HTTPException(status_code=400, detail=str(exc))
+    return {"removed": ip, "allowed_ips": allowed,
+            "firewall": await _sync_allowlist(ip, add=False)}
+
+
+async def _sync_allowlist(ip: str, *, add: bool) -> str:
+    """Make an allowlist edit take effect at both layers; return the firewall note.
+
+    The middleware caches the allowlist, so it is told to re-read. The host
+    firewall now only admits allowlisted IPs (`sdk.firewall.ensure_restricted`),
+    so a new IP also needs its kernel rule — applied when the panel is privileged,
+    otherwise the note carries the command. Off the event loop: it shells out.
+    """
+    import asyncio
+
+    from sdk import firewall
+    from sdk.ui.ip_allowlist import invalidate
+
+    invalidate()
+    try:
+        _ok, msg = await asyncio.to_thread(firewall.apply_ip, ip, add=add)
+    except Exception as exc:  # noqa: BLE001 — the allowlist change already stands
+        msg = f"firewall not updated: {exc}"
+    return msg
 
 
 # ── GitHub trigger (PR-only / push-only; never merges) ───────────────────────