devops-bot-sdk 1.7.43__tar.gz → 1.7.46__tar.gz

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.46}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.7.43
+Version: 1.7.46
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.46}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.7.43
+Version: 1.7.46
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.46}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -235,6 +235,7 @@ tests/test_log_colors_backlog.py
 tests/test_mcp_route_contract.py
 tests/test_memory_guard.py
 tests/test_model_policy.py
+tests/test_one_allowed_ip.py
 tests/test_panel_help.py
 tests/test_panel_ticket_schedules.py
 tests/test_parallel_tickets.py
@@ -279,6 +280,7 @@ tests/test_ticket_run_resolve_by_id.py
 tests/test_ticket_schedule_and_agent.py
 tests/test_ticket_speed_fixes.py
 tests/test_tier_flag_parity.py
+tests/test_ui_bruteforce_guard.py
 tests/test_ui_gate.py
 tests/test_ui_lifespan.py
 tests/test_ui_no_native_dialogs.py

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.46}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.7.43
+Version: 1.7.46
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.7.43"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.7.46"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.46}/sdk/cli.py

@@ -104,11 +104,17 @@ Command surface:
         default; `--apply` executes them and needs root / Administrator. The host
         firewall is a separate layer the allowlist cannot reach, and the two drifting
         apart is what silently blinded every VPS when the backend's egress IP moved.
-        `--any` opens the port to every source instead, leaving
-        IPAllowlistMiddleware as the gate — the more robust choice when the
-        backend's egress IP can move, since a stale per-IP kernel rule drops the
-        SYN before the allowlist is ever consulted. This is what runs
-        automatically after a self-update. See sdk.firewall.
+        `--apply` also removes the open-to-any rule and any rule for an IP no
+        longer allowed; this is what runs automatically after a self-update.
+        `--any` opens the port to every source instead (not recommended: every
+        scanner then reaches the panel). See sdk.firewall.
+
+    agentos allow-ip [IP | --clear]
+        Show, set or clear THE one outside IP allowed to reach the panel (besides
+        this machine and the backend). Only one at a time: a new IP replaces the
+        old one in the allowlist and the host firewall. Same-machine only — this
+        command over SSH, or the panel opened at http://127.0.0.1:8765 on the box;
+        the remote API refuses. The firewall half needs root. See sdk.firewall.
 
     agentos swagger [--open] [--json [PATH]] [--port N]
         Where the panel's Swagger UI is and whether it can actually be reached:
@@ -223,6 +229,10 @@ def main() -> None:
         _github_command(rest)
         return
 
+    if noun == "allow-ip":
+        from sdk import firewall
+        sys.exit(firewall.allow_ip_cli(rest))
+
     if noun == "firewall":
         from sdk import firewall
         sys.exit(firewall.cli(rest))
@@ -264,7 +274,7 @@ def main() -> None:
 
 
 def _print_usage() -> None:
-    print("usage: agentos <configure|chat|agent|ticket|integration|default-agents|agentd|github|report|browser|fallback|help|doctor|firewall|activity-setup|swagger> ...")
+    print("usage: agentos <configure|chat|agent|ticket|integration|default-agents|agentd|github|report|browser|fallback|help|doctor|firewall|allow-ip|activity-setup|swagger> ...")
     print()
     print('  agentos version (or --version)     # installed SDK version, Python and install path')
     print('  agentos help "<your problem>" [--file PATH]…  # DevOps Bot Help: reads your logs + the SDK (+ screenshots/logs you attach)')
@@ -284,7 +294,8 @@ def _print_usage() -> None:
     print("  agentos report <submit|list|show ID>                 # report work Jira/GitHub never saw")
     print("  agentos browser <login URL|status|logout>            # sign in once; private links become readable")
     print("  agentos fallback <install|login|status|logout>       # the AI Draftsman CLI used when claude is not working")
-    print("  agentos firewall [--apply] [--revoke IP] [--port N]  # open the UI port to the allowlisted IPs")
+    print("  agentos allow-ip [IP | --clear]                     # the ONE outside IP allowed to reach the panel")
+    print("  agentos firewall [--apply] [--revoke IP] [--port N]  # limit the UI port to the allowlisted IPs")
     print("  agentos firewall --any [--apply]                     # open the UI port to any source (allowlist is the gate)")
     print("  agentos swagger [--open] [--json [PATH]]             # where /docs is, and can you reach it")
 

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.46}/sdk/config.py

@@ -227,36 +227,64 @@ def _parse_ip_list(raw: str) -> list[str]:
 
 
 def get_allowed_ips() -> list[str]:
-    """Client IPs permitted to reach the ``agentos-ui`` API (``/api/ui/*``).
+    """Client IPs permitted to reach the ``agentos-ui`` server: the built-in backend
+    IP(s) plus AT MOST ONE user IP.
 
-    This is the allowlist for the *inbound* half of the two-way link: the AI
-    backend (and only it) may call back into the SDK server. Loopback is always
-    trusted separately — this list is for the AI-backend IP(s) you whitelist.
+    ONE user IP at a time is the rule — the panel is reachable from a single
+    outside address, so a leaked token is useless anywhere else and the host
+    firewall (`sdk.firewall.ensure_restricted`) admits exactly that address.
+    Loopback and this host's own IPs are always trusted separately.
 
-    Sources, merged (all optional), each accepting a comma/space-separated or
-    bracketed list of strings:
-      - ``.env`` key ``AGENTOS_UI_ALLOWED_IPS`` (``~/.agentos/.env`` or CWD ``.env``)
-      - process env ``AGENTOS_UI_ALLOWED_IPS``
-      - config.toml key ``allowed_ips``
-
-    Returns a de-duplicated list (empty means "loopback only"). Supplying the
-    AI-backend IP here later is all that's needed to open the link — no code
-    change. CIDR/prefix entries are supported by the middleware.
+    The user IP is chosen by :func:`user_allowed_ip`; anything else configured is
+    ignored and reported by :func:`ignored_allowed_ips`.
     """
-    sources = [
-        ",".join(_DEFAULT_ALLOWED_IPS),                 # built-in backend IP(s) — always allowed
-        _dotenv_value("AGENTOS_UI_ALLOWED_IPS"),
-        os.environ.get("AGENTOS_UI_ALLOWED_IPS", ""),
-        _load_raw().get("allowed_ips", ""),
-    ]
+    out = list(_DEFAULT_ALLOWED_IPS)
+    user = user_allowed_ip()
+    if user and user not in out:
+        out.append(user)
+    return out
+
+
+def _single_address(value: str) -> bool:
+    """True for one host address (a bare IP, or a /32 / /128) — not a range."""
+    import ipaddress
+    try:
+        return ipaddress.ip_network(value.strip(), strict=False).num_addresses == 1
+    except ValueError:
+        return False
+
+
+def _configured_user_ips() -> list[str]:
+    """Every non-backend entry configured anywhere, oldest source first:
+    ``.env``, process env, then config.toml (the runtime / API-added one)."""
     out: list[str] = []
-    for src in sources:
+    for src in (_dotenv_value("AGENTOS_UI_ALLOWED_IPS"),
+                os.environ.get("AGENTOS_UI_ALLOWED_IPS", ""),
+                _load_raw().get("allowed_ips", "")):
         for ip in _parse_ip_list(src):
-            if ip not in out:
+            if ip not in _DEFAULT_ALLOWED_IPS and ip not in out:
                 out.append(ip)
     return out
 
 
+def user_allowed_ip() -> str | None:
+    """The ONE user IP allowed to reach the panel, or None.
+
+    The most recent wins: the runtime entry (config.toml — set by
+    ``POST /api/ui/allowlist``) over ``.env``, and within a source the LAST entry,
+    since the documented way to add an IP is to append it. CIDR ranges are never
+    chosen — a range is many IPs.
+    """
+    candidates = [ip for ip in _configured_user_ips() if _single_address(ip)]
+    return candidates[-1] if candidates else None
+
+
+def ignored_allowed_ips() -> list[str]:
+    """Configured user IPs/ranges that are NOT allowed, because only one may be."""
+    keep = user_allowed_ip()
+    return [ip for ip in _configured_user_ips() if ip != keep]
+
+
 # Built-in baseline of tools a headless agent run may use. Kept here (not in
 # local_exec) so it is one configurable setting rather than a literal buried in the
 # spawn code: the set WILL grow, and a new tool must be addable without editing
@@ -434,23 +462,23 @@ def journal_enabled() -> bool:
 
 
 def add_allowed_ip(ip: str) -> list[str]:
-    """Whitelist an IP/CIDR at RUNTIME (persisted to config.toml ``allowed_ips``).
+    """Make ``ip`` THE user IP at runtime (persisted to config.toml ``allowed_ips``).
 
-    Idempotent. The middleware re-reads the allowlist per request, so the IP is
-    honoured immediately (no restart) and stays until disabled. An IP already
-    permanently whitelisted via ``.env`` is left as-is (no runtime duplicate).
-    Returns the merged allowlist.
+    Only one user IP may reach the panel at a time, so this REPLACES whichever was
+    there before — including one from ``.env``, which it outranks while set.
+    Idempotent. The middleware sees it on the next request; the caller updates the
+    host firewall. A backend IP is already allowed and is left alone. Returns the
+    effective allowlist.
     """
     ip = (ip or "").strip()
     if not ip:
         raise ValueError("ip is required")
-    if ip in permanent_allowed_ips():                   # already permanent — nothing to add
+    if not _single_address(ip):
+        raise ValueError(f"{ip} is a range — only one IP may be allowed at a time")
+    if ip in _DEFAULT_ALLOWED_IPS:
         return get_allowed_ips()
     raw = _load_raw()                                   # preserves token_enc / base_url / etc.
-    entries = _parse_ip_list(raw.get("allowed_ips", ""))
-    if ip not in entries:
-        entries.append(ip)
-    raw["allowed_ips"] = ", ".join(entries)
+    raw["allowed_ips"] = ip
     _save_raw(raw)
     return get_allowed_ips()
 

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.46}/sdk/faqs.py

@@ -21,22 +21,17 @@ FAQS: list[tuple[str, str, str]] = [
     ("Basics", "How do I open the control panel from another machine?",
      "**Easiest — an SSH tunnel (nothing to open):** on your machine run "
      "`ssh -L 8765:127.0.0.1:8765 you@SERVER`, then browse `http://127.0.0.1:8765`.\n"
-     "**Directly by IP:**\n"
-     "1. On YOUR machine, find your public IP: `curl -s https://api.ipify.org; echo` → prints e.g. `203.0.113.7`\n"
-     "2. On the SERVER, allowlist it: `echo 'AGENTOS_UI_ALLOWED_IPS=203.0.113.7' >> ~/.agentos/.env` — if that "
-     "line is already there, add the IP to it instead (only the first line counts): "
-     "`sed -i 's/^AGENTOS_UI_ALLOWED_IPS=.*/&,203.0.113.7/' ~/.agentos/.env`\n"
-     "3. Check it: `grep AGENTOS_UI_ALLOWED_IPS ~/.agentos/.env` → `AGENTOS_UI_ALLOWED_IPS=203.0.113.7` "
-     "(or your earlier IPs, then `,203.0.113.7`)\n"
-     "4. Open the port: `agentos firewall --apply` (needs sudo rights; if it can't, it prints the `ufw` command to run)\n"
-     "**On a Windows server** (PowerShell): `(Invoke-RestMethod https://api.ipify.org)` for your IP; "
-     "`Add-Content \"$env:USERPROFILE\\.agentos\\.env\" \"AGENTOS_UI_ALLOWED_IPS=203.0.113.7\"` the first time, or "
-     "`(Get-Content $f) -replace '^(AGENTOS_UI_ALLOWED_IPS=.*)$','$1,203.0.113.7' | Set-Content $f` "
-     "(with `$f = \"$env:USERPROFILE\\.agentos\\.env\"`) to add to an existing line; "
-     "`agentos firewall --apply` in an Administrator PowerShell. In cmd: "
-     "`echo AGENTOS_UI_ALLOWED_IPS=203.0.113.7>> \"%USERPROFILE%\\.agentos\\.env\"` (no space before `>>`).\n"
-     "5. Browse `http://SERVER-IP:8765` and paste your co_ token. It works at once — no restart. "
-     "`agentos swagger` shows whether the port is reachable and which allowlisted IPs the firewall still blocks."),
+     "**Directly by IP** — only ONE outside IP can open the panel at a time, and only someone on the "
+     "server can set it:\n"
+     "1. On YOUR machine, find your public IP: `curl -s https://api.ipify.org; echo` → prints e.g. `203.0.113.7` "
+     "(Windows PowerShell: `Invoke-RestMethod https://api.ipify.org`)\n"
+     "2. On the SERVER (over SSH): `agentos allow-ip 203.0.113.7` — this REPLACES the previous IP, which loses access. "
+     "Or open the panel on the server itself (`http://127.0.0.1:8765`) → Dashboard → **Remote access**.\n"
+     "3. If it says the firewall needs root: `sudo agentos firewall --apply` (Windows: `agentos firewall --apply` "
+     "in an Administrator PowerShell).\n"
+     "4. Browse `http://SERVER-IP:8765` and paste your co_ token. `agentos allow-ip` shows the allowed IP; "
+     "`agentos allow-ip --clear` removes it. The remote API cannot change it, so a leaked token cannot "
+     "open the panel to another address."),
     ("Basics", "How do I use devops-bot-sdk on another machine?",
      "Install it there too — the same checklist (Python, git, SSH key, repo access, claude or ad), then "
      "`pip install \"git+ssh://git@github.com/consultancy-outfit/DevOpsBot-SDK.git\"` and `agentos configure` "

{devops_bot_sdk-1.7.43 → devops_bot_sdk-1.7.46}/sdk/firewall.py

@@ -19,10 +19,12 @@ from the *same* list the middleware enforces, so the two layers cannot drift.
     agentos firewall --any --apply# open the port, leaving the allowlist as the gate
     agentos firewall --revoke IP  # print the matching delete rule
 
-``--any`` is also what runs automatically after a self-update
-(``updater._ensure_firewall``), because a pip upgrade replaces code and
-nothing else — a host whose kernel drops the SYNs stays broken across every
-update while reporting a healthy version.
+After a self-update ``updater._ensure_firewall`` runs :func:`ensure_restricted`:
+it adds a per-IP rule for every allowlisted address and REMOVES the open-to-any
+rule. It used to run ``--any``, and that left every VPS with 8765 open to the
+internet: each brute-force/scanner request then reached Python before the
+allowlist refused it, and a flood pinned the panel at 100% CPU. Open-to-any is
+now only kept when the operator chose it with ``AGENTOS_FIREWALL_OPEN_ANY=1``.
 
 Applying is deliberately opt-in: editing a live firewall is exactly the operation
 that can lock an operator out of their own box, so the default is to print and let
@@ -30,6 +32,7 @@ a human read it first.
 """
 from __future__ import annotations
 
+import ipaddress
 import os
 import platform
 import shutil
@@ -111,10 +114,13 @@ def allow_any_rules(port: int, system: str | None = None) -> list[str]:
       corrected in seconds without root on the box, which is exactly what a
       kernel rule cannot offer.
 
-    So: open the port, keep the decision in the allowlist. Use
-    :func:`allow_rules` instead when the host must not accept a connection from
-    an unlisted address at all (a shared or hostile network), and accept that a
-    backend IP change then needs a root session on every host.
+    That reasoning held for *access* but not for *load*: every request from the
+    internet still costs a Python round-trip before the allowlist refuses it, and
+    a brute-force flood took panels to 100% CPU. So this is no longer the default
+    — :func:`ensure_restricted` is — and is kept only for an operator who opts
+    in with ``AGENTOS_FIREWALL_OPEN_ANY=1``. A backend IP move
+    is still self-healing: the new IP goes in ``_DEFAULT_ALLOWED_IPS`` and the
+    next self-update adds its rule.
     """
     sysname = (system or _system()).lower()
 
@@ -201,6 +207,17 @@ def ensure_open(port: int | None = None, *, apply: bool = True) -> tuple[bool, s
         who = "Administrator" if sysname == "windows" else "root (sudo)"
         return (False, f"TCP {port} is not open and opening it needs {who}:\n{printable}")
 
+    failed = _apply_rules(rules)
+    if failed:
+        return (False, "could not open TCP %d: %s" % (port, "; ".join(failed)))
+    return (True, f"opened TCP {port} inbound")
+
+
+def _apply_rules(rules: list[str]) -> list[str]:
+    """Run each rule (already privileged, so a printed ``sudo `` is stripped).
+
+    Returns one ``"<cmd>: <reason>"`` per failure — empty means all applied.
+    """
     failed: list[str] = []
     for rule in rules:
         cmd = rule[len("sudo "):] if rule.startswith("sudo ") else rule
@@ -214,9 +231,130 @@ def ensure_open(port: int | None = None, *, apply: bool = True) -> tuple[bool, s
         if proc.returncode != 0:
             tail = (proc.stderr or proc.stdout or "").strip().splitlines()
             failed.append(f"{cmd}: {tail[-1][:120] if tail else f'exit {proc.returncode}'}")
+    return failed
+
+
+def _net(value: str):
+    """``value`` as an ip_network, or None — so ``1.2.3.4`` and ``1.2.3.4/32`` match."""
+    try:
+        return ipaddress.ip_network(value.strip(), strict=False)
+    except ValueError:
+        return None
+
+
+def open_any_opted_in() -> bool:
+    """Has the operator chosen to keep the port open to any source?
+
+    Only an explicit ``AGENTOS_FIREWALL_OPEN_ANY=1`` — read from the process env
+    or ``~/.agentos/.env``, like every other ``AGENTOS_UI_*`` toggle. (The removed
+    ``AGENTOS_UI_PUBLIC=1`` used to imply it.)
+    """
+    try:
+        from sdk.ui.ip_allowlist import _TRUE, _setting
+    except Exception:  # noqa: BLE001 — never fail open on an import hiccup
+        return False
+    return _setting("AGENTOS_FIREWALL_OPEN_ANY").lower() in _TRUE
+
+
+def ensure_restricted(port: int | None = None, *, apply: bool = True,
+                      ips: list[str] | None = None) -> tuple[bool, str]:
+    """Limit ``port`` to EXACTLY the allowlisted IPs. Returns ``(changed, message)``.
+    Never raises.
+
+    Adds a per-IP rule for each allowlisted address that lacks one, THEN removes
+    the open-to-any rule and every per-IP rule for an address no longer allowed
+    (only one user IP may reach the panel, so replacing it must close the old
+    one) — in that order, and the removals are skipped if any add failed, so the
+    backend never loses its route mid-change. Same contract as
+    :func:`ensure_open` otherwise: unreadable state is never treated as closed,
+    an unprivileged run only returns the commands, and macOS never applies.
+
+    A message that needs the operator to act is multi-line (it carries commands),
+    which is what ``updater._ensure_firewall`` keys on to surface it.
+    """
+    port = ui_port() if port is None else port
+    sysname = _system()
+    if ips is None:
+        try:
+            from sdk.config import get_allowed_ips
+            ips = get_allowed_ips()
+        except Exception:  # noqa: BLE001
+            ips = []
+
+    try:
+        sources = port_sources(port, sysname, collapse=False)
+    except Exception:  # noqa: BLE001 — a status probe must never break an update
+        sources = None
+
+    inactive_note = ""
+    if sysname == "linux" and _ufw_inactive():
+        inactive_note = ("\nNOTE: ufw is INACTIVE, so no rule is enforced and the port is open "
+                         "to everyone.\nEnable it once you have allowed SSH:\n"
+                         "  sudo ufw allow OpenSSH && sudo ufw enable")
+
+    if sources is None:
+        rules = allow_rules(ips, port, sysname) + [revoke_any_rule(port, sysname)]
+        printable = "  " + "\n  ".join(rules)
+        ok, tool = _tool_present()
+        why = tool if not ok else "needs root to read the firewall state"
+        return (False, f"could not read the firewall state ({why}) — to restrict TCP {port} "
+                       f"to the allowlist yourself:\n{printable}")
+
+    have = {n for n in (_net(x) for x in sources) if n is not None}
+    want = {n for n in (_net(ip) for ip in ips) if n is not None}
+    missing = [ip for ip in ips if _net(ip) is not None and _net(ip) not in have]
+    stale = sorted(x for x in sources if _net(x) is not None and _net(x) not in want)
+    open_any = "Anywhere" in sources
+
+    if not missing and not open_any and not stale:
+        return (False, f"TCP {port} is restricted to the allowlist" + inactive_note)
+
+    removals = ([revoke_any_rule(port, sysname)] if open_any else []) + [
+        revoke_rule(x, port, sysname) for x in stale]
+    rules = allow_rules(missing, port, sysname) + removals
+    printable = "  " + "\n  ".join(rules)
+    what = "; ".join(w for w in (
+        f"TCP {port} is open to ANY source" if open_any else "",
+        f"missing a rule for: {', '.join(missing)}" if missing else "",
+        f"still allows: {', '.join(stale)}" if stale else "",
+    ) if w)
+
+    if not apply or sysname == "darwin":
+        return (False, f"{what}. To restrict it to the allowlist:\n{printable}" + inactive_note)
+    if not _is_privileged():
+        who = "Administrator" if sysname == "windows" else "root (sudo)"
+        return (False, f"{what} and restricting it needs {who}:\n{printable}" + inactive_note)
+
+    failed = _apply_rules(allow_rules(missing, port, sysname))
     if failed:
-        return (False, "could not open TCP %d: %s" % (port, "; ".join(failed)))
-    return (True, f"opened TCP {port} inbound")
+        # The any-rule stays: removing it now could cut the backend off.
+        return (False, f"could not add allowlist rules for TCP {port}: {'; '.join(failed)}"
+                       f"\nThe open-to-any rule was left in place.")
+    if removals:
+        _apply_rules(removals)
+        still = port_sources(port, sysname, collapse=False) or set()
+        left = sorted(x for x in still
+                      if x == "Anywhere" or (_net(x) is not None and _net(x) not in want))
+        if left:
+            return (True, f"TCP {port} still allows {', '.join(left)} — a rule the SDK did "
+                          f"not create. Find and delete it:\n  "
+                          + ("sudo ufw status numbered" if sysname == "linux" else
+                             "netsh advfirewall firewall show rule name=all dir=in")
+                          + inactive_note)
+    return (True, f"restricted TCP {port} to the allowlist: {', '.join(ips)}" + inactive_note)
+
+
+def sync_rules(port: int | None = None) -> tuple[bool, str]:
+    """Bring the host firewall in line with the allowlist after it changed.
+
+    Called when the one user IP is set or cleared (CLI or panel), so the new IP's
+    rule is added and the old one's removed straight away rather than at the next
+    self-update. Leaves a deliberately open port alone. Never raises.
+    """
+    if open_any_opted_in():
+        return (False, "port is open to any source by choice (AGENTOS_FIREWALL_OPEN_ANY) — "
+                       "no per-IP rules to change")
+    return ensure_restricted(port)
 
 
 def revoke_rule(ip: str, port: int, system: str | None = None) -> str:
@@ -310,7 +448,8 @@ def _parse_netsh(text: str, port: int) -> set[str]:
     return out
 
 
-def port_sources(port: int, system: str | None = None) -> set[str] | None:
+def port_sources(port: int, system: str | None = None, *,
+                 collapse: bool = True) -> set[str] | None:
     """Which sources the HOST firewall currently allows to ``port``.
 
     ``{"Anywhere"}`` means open to the world. **``None`` means the state could not
@@ -322,6 +461,9 @@ def port_sources(port: int, system: str | None = None) -> set[str] | None:
     (`sdk.config.get_allowed_ips`) and the host firewall are separate layers, and
     the interesting question is where they DISAGREE — an IP the app permits but the
     kernel drops looks exactly like a broken backend.
+
+    ``collapse=False`` keeps the per-IP sources alongside ``"Anywhere"`` — what
+    :func:`ensure_restricted` needs to know which IP rules already exist.
     """
     sysname = (system or _system()).lower()
     if sysname == "linux":
@@ -329,17 +471,27 @@ def port_sources(port: int, system: str | None = None) -> set[str] | None:
         if text is None:
             return None
         got = _parse_ufw(text, port)
-        return {"Anywhere"} if "Anywhere" in got else got
+        return {"Anywhere"} if collapse and "Anywhere" in got else got
     if sysname == "windows":
         text = _run(["netsh", "advfirewall", "firewall", "show", "rule",
                      "name=all", "dir=in"], timeout=25.0)
         if text is None:
             return None
         got = _parse_netsh(text, port)
-        return {"Anywhere"} if "Anywhere" in got else got
+        return {"Anywhere"} if collapse and "Anywhere" in got else got
     return None          # macOS pf and anything else: not readable this way
 
 
+def _ufw_inactive() -> bool:
+    """True only when ufw positively reports ``Status: inactive``.
+
+    Then every ufw rule is decoration and the port is open regardless — the
+    "per-IP rules are applied but the flood still arrives" case.
+    """
+    text = _run(["ufw", "status"])
+    return bool(text) and "status: inactive" in text.lower()
+
+
 def _is_privileged() -> bool:
     if _system() == "windows":
         try:
@@ -382,10 +534,9 @@ def cli(argv: list[str]) -> int:
     print(f"Allowed  : {', '.join(ips) if ips else '(none — loopback only)'}")
 
     # `--any` opens the port to every source and leaves the decision to
-    # IPAllowlistMiddleware. This is what the post-update hook uses; see
-    # `allow_any_rules` for why a per-IP kernel rule is the more fragile of the
-    # two. It does NOT need an allowlist to be populated first, so it is checked
-    # before the "nothing to open" bail below.
+    # IPAllowlistMiddleware. NOT the default any more (see `allow_any_rules`):
+    # every internet scanner then reaches Python. It does NOT need an allowlist to
+    # be populated first, so it is checked before the "nothing to open" bail below.
     if "--any" in argv or "--open" in argv:
         current = port_sources(port, sysname)
         if current:
@@ -403,7 +554,10 @@ def cli(argv: list[str]) -> int:
         for r in rules:
             print(f"  {r}")
         print("\nAccess is still gated by the app allowlist above — an unlisted IP is\n"
-              "refused by IPAllowlistMiddleware even with the port open.")
+              "refused by IPAllowlistMiddleware even with the port open.\n"
+              "WARNING: every scanner on the internet can then reach the panel process;\n"
+              "a brute-force flood costs CPU even though it is refused. The next\n"
+              "self-update narrows it back unless AGENTOS_FIREWALL_OPEN_ANY=1 is set.")
         if "--apply" not in argv:
             print("\n(dry run — nothing changed. Re-run with --apply to execute.)")
             return 0
@@ -417,6 +571,9 @@ def cli(argv: list[str]) -> int:
         return 0
 
     rules = allow_rules(ips, port, sysname)
+    if "Anywhere" in (port_sources(port, sysname) or set()):
+        rules.append(revoke_any_rule(port, sysname))
+        print(f"\nTCP {port} is currently open to ANY source — the last rule removes that.")
     print("\nFirewall rules for this host:\n")
     for r in rules:
         print(f"  {r}")
@@ -445,27 +602,65 @@ def cli(argv: list[str]) -> int:
         print(f"\nerror: --apply needs {who}.")
         return 1
 
-    failed = 0
-    print()
-    for r in rules:
-        # The printed form carries `sudo` for humans; we are already privileged.
-        cmd = r[len("sudo "):] if r.startswith("sudo ") else r
+    changed, msg = ensure_restricted(port, apply=True, ips=ips)
+    print(f"\n{msg}")
+    return 0 if changed or "restricted to the allowlist" in msg else 1
+
+
+def allow_ip_cli(argv: list[str]) -> int:
+    """``agentos allow-ip [IP | --clear]`` — set, show or clear THE one user IP.
+
+    Only one outside IP may reach the panel at a time; setting a new one replaces
+    the old one in the allowlist and in the host firewall. This command is one of
+    the two ways to change it — both need someone on the machine (this one over
+    SSH, or the panel opened at http://127.0.0.1:8765 on the box); the remote API
+    refuses. Run it as the user the panel runs as, so it edits that user's
+    ~/.agentos/config.toml; the firewall half needs root and prints the command
+    otherwise.
+    """
+    from sdk import config
+
+    def show() -> None:
+        user = config.user_allowed_ip()
+        print(f"Allowed user IP : {user or '(none — only this machine and the backend)'}")
+        print(f"Backend IPs     : {', '.join(config._DEFAULT_ALLOWED_IPS)}")
+        ignored = config.ignored_allowed_ips()
+        if ignored:
+            print(f"Ignored         : {', '.join(ignored)}  (only one user IP is allowed at a time)")
+
+    args = [a for a in argv if a.strip()]
+    if not args or args[0] in ("--show", "show"):
+        show()
+        return 0
+
+    if args[0] in ("--clear", "clear", "--remove"):
+        user = config.user_allowed_ip()
+        runtime = [ip for ip in config.runtime_allowed_ips() if ip == user]
+        if not runtime:
+            if user:
+                print(f"{user} comes from AGENTOS_UI_ALLOWED_IPS in ~/.agentos/.env — "
+                      "remove it there.")
+                return 1
+            print("No user IP is allowed — nothing to clear.")
+            return 0
+        config.remove_allowed_ip(user)
+        print(f"✓ removed {user}")
+    else:
+        ip = args[0]
+        before = config.user_allowed_ip()
         try:
-            proc = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
-        except Exception as exc:  # noqa: BLE001 — never leave the firewall half-known
-            print(f"  ✗ {cmd}\n      {exc}")
-            failed += 1
-            continue
-        tail = (proc.stdout or proc.stderr or "").strip().splitlines()
-        note = tail[-1][:100] if tail else ""
-        if proc.returncode == 0:
-            print(f"  ✓ {cmd}\n      {note}" if note else f"  ✓ {cmd}")
-        else:
-            print(f"  ✗ {cmd}  (exit {proc.returncode})\n      {note}")
-            failed += 1
-
-    print(f"\n{len(rules) - failed}/{len(rules)} applied.")
-    return 1 if failed else 0
+            config.add_allowed_ip(ip)
+        except ValueError as exc:
+            print(f"error: {exc}")
+            return 2
+        print(f"✓ {ip} is now the one IP allowed to reach the panel")
+        if before and before != ip:
+            print(f"  (replaced {before} — it no longer has access)")
+
+    changed, msg = sync_rules()
+    print(("↻ " if changed else "") + msg)
+    show()
+    return 0
 
 
 if __name__ == "__main__":  # pragma: no cover