devops-bot-sdk 1.7.45__tar.gz → 1.7.47__tar.gz

{devops_bot_sdk-1.7.45 → devops_bot_sdk-1.7.47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.7.45
+Version: 1.7.47
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.7.45 → devops_bot_sdk-1.7.47}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.7.45
+Version: 1.7.47
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.7.45 → devops_bot_sdk-1.7.47}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -190,6 +190,7 @@ tests/test_allowed_tools_config.py
 tests/test_approval_park.py
 tests/test_auto_agent_dispatch.py
 tests/test_auto_ticket_queue.py
+tests/test_backend_only_allowlist.py
 tests/test_browser_profile.py
 tests/test_cheap_tier.py
 tests/test_claude_usage_gate.py

{devops_bot_sdk-1.7.45 → devops_bot_sdk-1.7.47}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.7.45
+Version: 1.7.47
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.7.45"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.7.47"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.7.45 → devops_bot_sdk-1.7.47}/sdk/cli.py

@@ -104,11 +104,17 @@ Command surface:
         default; `--apply` executes them and needs root / Administrator. The host
         firewall is a separate layer the allowlist cannot reach, and the two drifting
         apart is what silently blinded every VPS when the backend's egress IP moved.
-        `--any` opens the port to every source instead, leaving
-        IPAllowlistMiddleware as the gate — the more robust choice when the
-        backend's egress IP can move, since a stale per-IP kernel rule drops the
-        SYN before the allowlist is ever consulted. This is what runs
-        automatically after a self-update. See sdk.firewall.
+        `--apply` also removes the open-to-any rule and any rule for an IP no
+        longer allowed; this is what runs automatically after a self-update.
+        `--any` opens the port to every source instead (not recommended: every
+        scanner then reaches the panel). See sdk.firewall.
+
+    agentos allow-ip [--clear]
+        Show who may reach the panel: this machine and the DevOps Bot backend only
+        — no outside IP (since 1.7.47). `agentos allow-ip <IP>` is refused (exit 2)
+        with the SSH-tunnel alternative (ssh -L 8765:127.0.0.1:8765 <user>@<server>).
+        `--clear` removes outside IPs an older SDK left in config.toml and syncs the
+        host firewall (that half needs root). See sdk.firewall.
 
     agentos swagger [--open] [--json [PATH]] [--port N]
         Where the panel's Swagger UI is and whether it can actually be reached:
@@ -223,6 +229,10 @@ def main() -> None:
         _github_command(rest)
         return
 
+    if noun == "allow-ip":
+        from sdk import firewall
+        sys.exit(firewall.allow_ip_cli(rest))
+
     if noun == "firewall":
         from sdk import firewall
         sys.exit(firewall.cli(rest))
@@ -264,7 +274,7 @@ def main() -> None:
 
 
 def _print_usage() -> None:
-    print("usage: agentos <configure|chat|agent|ticket|integration|default-agents|agentd|github|report|browser|fallback|help|doctor|firewall|activity-setup|swagger> ...")
+    print("usage: agentos <configure|chat|agent|ticket|integration|default-agents|agentd|github|report|browser|fallback|help|doctor|firewall|allow-ip|activity-setup|swagger> ...")
     print()
     print('  agentos version (or --version)     # installed SDK version, Python and install path')
     print('  agentos help "<your problem>" [--file PATH]…  # DevOps Bot Help: reads your logs + the SDK (+ screenshots/logs you attach)')
@@ -284,7 +294,8 @@ def _print_usage() -> None:
     print("  agentos report <submit|list|show ID>                 # report work Jira/GitHub never saw")
     print("  agentos browser <login URL|status|logout>            # sign in once; private links become readable")
     print("  agentos fallback <install|login|status|logout>       # the AI Draftsman CLI used when claude is not working")
-    print("  agentos firewall [--apply] [--revoke IP] [--port N]  # open the UI port to the allowlisted IPs")
+    print("  agentos allow-ip [--clear]                          # who may reach the panel (no outside IP; use an SSH tunnel)")
+    print("  agentos firewall [--apply] [--revoke IP] [--port N]  # limit the UI port to the allowlisted IPs")
     print("  agentos firewall --any [--apply]                     # open the UI port to any source (allowlist is the gate)")
     print("  agentos swagger [--open] [--json [PATH]]             # where /docs is, and can you reach it")
 

{devops_bot_sdk-1.7.45 → devops_bot_sdk-1.7.47}/sdk/config.py

@@ -227,36 +227,39 @@ def _parse_ip_list(raw: str) -> list[str]:
 
 
 def get_allowed_ips() -> list[str]:
-    """Client IPs permitted to reach the ``agentos-ui`` API (``/api/ui/*``).
-
-    This is the allowlist for the *inbound* half of the two-way link: the AI
-    backend (and only it) may call back into the SDK server. Loopback is always
-    trusted separately — this list is for the AI-backend IP(s) you whitelist.
+    """Client IPs permitted to reach the ``agentos-ui`` server: the built-in backend
+    IP(s) and nothing else.
+
+    No outside user IP is allowed (since 1.7.47 — 1.7.46 allowed one). The panel is
+    for this machine and the DevOps Bot backend: open it on the server, or from
+    another computer through an SSH tunnel (``ssh -L 8765:127.0.0.1:8765 …``),
+    which arrives as loopback. Loopback and this host's own IPs are always trusted
+    separately. Anything still configured in ``AGENTOS_UI_ALLOWED_IPS`` or
+    config.toml ``allowed_ips`` is ignored and reported by
+    :func:`ignored_allowed_ips`; the host firewall (`sdk.firewall.ensure_restricted`)
+    removes its rule.
+    """
+    return list(_DEFAULT_ALLOWED_IPS)
 
-    Sources, merged (all optional), each accepting a comma/space-separated or
-    bracketed list of strings:
-      - ``.env`` key ``AGENTOS_UI_ALLOWED_IPS`` (``~/.agentos/.env`` or CWD ``.env``)
-      - process env ``AGENTOS_UI_ALLOWED_IPS``
-      - config.toml key ``allowed_ips``
 
-    Returns a de-duplicated list (empty means "loopback only"). Supplying the
-    AI-backend IP here later is all that's needed to open the link — no code
-    change. CIDR/prefix entries are supported by the middleware.
-    """
-    sources = [
-        ",".join(_DEFAULT_ALLOWED_IPS),                 # built-in backend IP(s) — always allowed
-        _dotenv_value("AGENTOS_UI_ALLOWED_IPS"),
-        os.environ.get("AGENTOS_UI_ALLOWED_IPS", ""),
-        _load_raw().get("allowed_ips", ""),
-    ]
+def _configured_user_ips() -> list[str]:
+    """Every non-backend entry configured anywhere, oldest source first:
+    ``.env``, process env, then config.toml (the runtime / API-added one)."""
     out: list[str] = []
-    for src in sources:
+    for src in (_dotenv_value("AGENTOS_UI_ALLOWED_IPS"),
+                os.environ.get("AGENTOS_UI_ALLOWED_IPS", ""),
+                _load_raw().get("allowed_ips", "")):
         for ip in _parse_ip_list(src):
-            if ip not in out:
+            if ip not in _DEFAULT_ALLOWED_IPS and ip not in out:
                 out.append(ip)
     return out
 
 
+def ignored_allowed_ips() -> list[str]:
+    """Configured outside IPs/ranges that are NOT allowed — none ever is."""
+    return _configured_user_ips()
+
+
 # Built-in baseline of tools a headless agent run may use. Kept here (not in
 # local_exec) so it is one configurable setting rather than a literal buried in the
 # spawn code: the set WILL grow, and a new tool must be addable without editing
@@ -311,26 +314,14 @@ class PermanentAllowlistEntry(ValueError):
 
 
 def permanent_allowed_ips() -> list[str]:
-    """IPs/CIDRs whitelisted **permanently** — from ``.env`` (``~/.agentos/.env`` or
-    CWD) or the ``AGENTOS_UI_ALLOWED_IPS`` process env var.
-
-    These are the fixed baseline: they are ALWAYS allowed and **cannot be disabled**
-    through the API — change them by editing ``.env`` and restarting.
-    """
-    out: list[str] = []
-    for src in (",".join(_DEFAULT_ALLOWED_IPS),          # built-in backend IP(s) — always permanent
-                _dotenv_value("AGENTOS_UI_ALLOWED_IPS"),
-                os.environ.get("AGENTOS_UI_ALLOWED_IPS", "")):
-        for ip in _parse_ip_list(src):
-            if ip not in out:
-                out.append(ip)
-    return out
+    """The IPs that are always allowed and cannot be disabled — the built-in
+    backend IP(s). ``AGENTOS_UI_ALLOWED_IPS`` no longer adds to them (1.7.47)."""
+    return list(_DEFAULT_ALLOWED_IPS)
 
 
 def runtime_allowed_ips() -> list[str]:
-    """IPs/CIDRs whitelisted **at runtime** (config.toml ``allowed_ips``) — added by
-    the whitelist endpoint and removable by the disable endpoint. They stay in the
-    allowlist until disabled."""
+    """IPs/CIDRs left in config.toml ``allowed_ips`` by an older SDK. Ignored since
+    1.7.47 (see :func:`get_allowed_ips`); ``agentos allow-ip --clear`` removes them."""
     return _parse_ip_list(_load_raw().get("allowed_ips", ""))
 
 
@@ -433,40 +424,15 @@ def journal_enabled() -> bool:
     return flag(FLAG_JOURNAL) or tiered_routing_enabled()
 
 
-def add_allowed_ip(ip: str) -> list[str]:
-    """Whitelist an IP/CIDR at RUNTIME (persisted to config.toml ``allowed_ips``).
-
-    Idempotent. The middleware re-reads the allowlist per request, so the IP is
-    honoured immediately (no restart) and stays until disabled. An IP already
-    permanently whitelisted via ``.env`` is left as-is (no runtime duplicate).
-    Returns the merged allowlist.
-    """
-    ip = (ip or "").strip()
-    if not ip:
-        raise ValueError("ip is required")
-    if ip in permanent_allowed_ips():                   # already permanent — nothing to add
-        return get_allowed_ips()
-    raw = _load_raw()                                   # preserves token_enc / base_url / etc.
-    entries = _parse_ip_list(raw.get("allowed_ips", ""))
-    if ip not in entries:
-        entries.append(ip)
-    raw["allowed_ips"] = ", ".join(entries)
-    _save_raw(raw)
-    return get_allowed_ips()
-
-
 def remove_allowed_ip(ip: str) -> list[str]:
-    """Disable a RUNTIME-whitelisted IP/CIDR (remove from config.toml ``allowed_ips``).
+    """Remove a leftover entry from config.toml ``allowed_ips`` (ignored anyway).
 
-    Raises :class:`PermanentAllowlistEntry` if the IP is permanently whitelisted via
-    ``.env`` — those are never removable through the API (edit ``.env`` instead).
-    Returns the merged allowlist.
+    Raises :class:`PermanentAllowlistEntry` for a backend IP. Returns the allowlist.
     """
     ip = (ip or "").strip()
     if ip in permanent_allowed_ips():
         raise PermanentAllowlistEntry(
-            f"{ip} is permanently whitelisted via .env (AGENTOS_UI_ALLOWED_IPS) — "
-            "it cannot be disabled through the API; edit .env and restart to change it."
+            f"{ip} is a DevOps Bot backend IP — it is always allowed and cannot be removed."
         )
     raw = _load_raw()
     entries = [x for x in _parse_ip_list(raw.get("allowed_ips", "")) if x != ip]

{devops_bot_sdk-1.7.45 → devops_bot_sdk-1.7.47}/sdk/faqs.py

@@ -19,24 +19,16 @@ FAQS: list[tuple[str, str, str]] = [
      "7. **Your co_ API token** — `agentos configure`\n"
      "Then `agentos doctor` checks the lot."),
     ("Basics", "How do I open the control panel from another machine?",
-     "**Easiest — an SSH tunnel (nothing to open):** on your machine run "
-     "`ssh -L 8765:127.0.0.1:8765 you@SERVER`, then browse `http://127.0.0.1:8765`.\n"
-     "**Directly by IP:**\n"
-     "1. On YOUR machine, find your public IP: `curl -s https://api.ipify.org; echo` → prints e.g. `203.0.113.7`\n"
-     "2. On the SERVER, allowlist it: `echo 'AGENTOS_UI_ALLOWED_IPS=203.0.113.7' >> ~/.agentos/.env` — if that "
-     "line is already there, add the IP to it instead (only the first line counts): "
-     "`sed -i 's/^AGENTOS_UI_ALLOWED_IPS=.*/&,203.0.113.7/' ~/.agentos/.env`\n"
-     "3. Check it: `grep AGENTOS_UI_ALLOWED_IPS ~/.agentos/.env` → `AGENTOS_UI_ALLOWED_IPS=203.0.113.7` "
-     "(or your earlier IPs, then `,203.0.113.7`)\n"
-     "4. Open the port: `agentos firewall --apply` (needs sudo rights; if it can't, it prints the `ufw` command to run)\n"
-     "**On a Windows server** (PowerShell): `(Invoke-RestMethod https://api.ipify.org)` for your IP; "
-     "`Add-Content \"$env:USERPROFILE\\.agentos\\.env\" \"AGENTOS_UI_ALLOWED_IPS=203.0.113.7\"` the first time, or "
-     "`(Get-Content $f) -replace '^(AGENTOS_UI_ALLOWED_IPS=.*)$','$1,203.0.113.7' | Set-Content $f` "
-     "(with `$f = \"$env:USERPROFILE\\.agentos\\.env\"`) to add to an existing line; "
-     "`agentos firewall --apply` in an Administrator PowerShell. In cmd: "
-     "`echo AGENTOS_UI_ALLOWED_IPS=203.0.113.7>> \"%USERPROFILE%\\.agentos\\.env\"` (no space before `>>`).\n"
-     "5. Browse `http://SERVER-IP:8765` and paste your co_ token. It works at once — no restart. "
-     "`agentos swagger` shows whether the port is reachable and which allowlisted IPs the firewall still blocks."),
+     "**Use an SSH tunnel** — no outside IP can be allowed; only the server itself and the DevOps Bot "
+     "backend reach the panel.\n"
+     "1. **Linux / macOS:** on your machine run `ssh -L 8765:127.0.0.1:8765 you@SERVER` and leave it open.\n"
+     "2. **Windows:** the same command in PowerShell (built-in OpenSSH client): "
+     "`ssh -L 8765:127.0.0.1:8765 you@SERVER`.\n"
+     "3. Browse `http://127.0.0.1:8765` on your machine — it arrives as loopback, so no IP to allow. "
+     "(Port 8765 busy locally? `ssh -L 9000:127.0.0.1:8765 …` and use `http://127.0.0.1:9000`.)\n"
+     "Or open `http://127.0.0.1:8765` on the server itself. `agentos allow-ip <IP>` is refused; "
+     "`agentos allow-ip` shows who may connect and `agentos allow-ip --clear` removes outside IPs an older "
+     "SDK left behind. A leaked token cannot open the panel to another address."),
     ("Basics", "How do I use devops-bot-sdk on another machine?",
      "Install it there too — the same checklist (Python, git, SSH key, repo access, claude or ad), then "
      "`pip install \"git+ssh://git@github.com/consultancy-outfit/DevOpsBot-SDK.git\"` and `agentos configure` "

{devops_bot_sdk-1.7.45 → devops_bot_sdk-1.7.47}/sdk/firewall.py

@@ -24,8 +24,7 @@ it adds a per-IP rule for every allowlisted address and REMOVES the open-to-any
 rule. It used to run ``--any``, and that left every VPS with 8765 open to the
 internet: each brute-force/scanner request then reached Python before the
 allowlist refused it, and a flood pinned the panel at 100% CPU. Open-to-any is
-now only kept when the operator chose it — ``AGENTOS_UI_PUBLIC=1`` (public mode
-needs the port reachable) or ``AGENTOS_FIREWALL_OPEN_ANY=1``.
+now only kept when the operator chose it with ``AGENTOS_FIREWALL_OPEN_ANY=1``.
 
 Applying is deliberately opt-in: editing a live firewall is exactly the operation
 that can lock an operator out of their own box, so the default is to print and let
@@ -118,8 +117,8 @@ def allow_any_rules(port: int, system: str | None = None) -> list[str]:
     That reasoning held for *access* but not for *load*: every request from the
     internet still costs a Python round-trip before the allowlist refuses it, and
     a brute-force flood took panels to 100% CPU. So this is no longer the default
-    — :func:`ensure_restricted` is — and is kept for public mode and for an
-    operator who opts in with ``AGENTOS_FIREWALL_OPEN_ANY=1``. A backend IP move
+    — :func:`ensure_restricted` is — and is kept only for an operator who opts
+    in with ``AGENTOS_FIREWALL_OPEN_ANY=1``. A backend IP move
     is still self-healing: the new IP goes in ``_DEFAULT_ALLOWED_IPS`` and the
     next self-update adds its rule.
     """
@@ -159,6 +158,41 @@ def revoke_any_rule(port: int, system: str | None = None) -> str:
     return f"# unsupported platform {sysname!r}"
 
 
+def revoke_any_rules(port: int, system: str | None = None,
+                     forms: list[str] | None = None) -> list[str]:
+    """Every command needed to remove the open-to-any rule(s) for ``port``.
+
+    ufw keeps ``8765/tcp`` and a bare ``8765`` (tcp+udp, what a hand-typed
+    ``ufw allow 8765`` makes) as DIFFERENT rules, and deleting one leaves the other
+    — the port then stays open to everyone after ``ufw delete allow 8765/tcp``.
+    ``forms`` are the ``To`` spellings ufw shows for the Anywhere rows; unknown
+    (None) → both, since deleting a rule that does not exist is harmless.
+    """
+    sysname = (system or _system()).lower()
+    if sysname != "linux":
+        return [revoke_any_rule(port, sysname)]
+    if forms is None:
+        forms = [f"{port}/tcp", str(port)]
+    return [f"sudo ufw delete allow {f}" for f in forms]
+
+
+def _ufw_any_forms(port: int) -> list[str] | None:
+    """The ``To`` spellings of the IPv4 open-to-any rows for ``port`` (e.g.
+    ``["8765/tcp", "8765"]``), or None when ufw cannot be read."""
+    text = _run(_ufw_argv() + ["status"])
+    if text is None:
+        return None
+    out: list[str] = []
+    for line in text.splitlines():
+        parts = line.split("#", 1)[0].split()
+        if (len(parts) >= 3 and "(v6)" not in line and parts[1].upper() == "ALLOW"
+                and parts[-1] == "Anywhere"
+                and (parts[0] == str(port) or parts[0].startswith(f"{port}/"))
+                and parts[0] not in out):
+            out.append(parts[0])
+    return out
+
+
 def ensure_open(port: int | None = None, *, apply: bool = True) -> tuple[bool, str]:
     """Make sure ``port`` is reachable. Returns ``(changed, message)``. Never raises.
 
@@ -198,7 +232,7 @@ def ensure_open(port: int | None = None, *, apply: bool = True) -> tuple[bool, s
         return (False, f"macOS: pf state is not readable and pf rules are file-based —\n{printable}")
     if sources is None:
         ok, tool = _tool_present()
-        why = tool if not ok else "needs root to read the firewall state"
+        why = tool if not ok else "needs root or passwordless sudo to read the firewall state"
         return (False, f"could not read the firewall state ({why}) — to open it yourself:\n{printable}")
 
     # Readable and genuinely empty for this port.
@@ -215,13 +249,16 @@ def ensure_open(port: int | None = None, *, apply: bool = True) -> tuple[bool, s
 
 
 def _apply_rules(rules: list[str]) -> list[str]:
-    """Run each rule (already privileged, so a printed ``sudo `` is stripped).
+    """Run each rule. As root a printed ``sudo `` is stripped; otherwise it becomes
+    ``sudo -n `` (passwordless sudo — see :func:`_sudo_n_ok`), which fails instead
+    of waiting for a password.
 
     Returns one ``"<cmd>: <reason>"`` per failure — empty means all applied.
     """
+    prefix = "sudo -n " if _sudo_n_ok() else ""
     failed: list[str] = []
     for rule in rules:
-        cmd = rule[len("sudo "):] if rule.startswith("sudo ") else rule
+        cmd = prefix + rule[len("sudo "):] if rule.startswith("sudo ") else rule
         try:
             proc = subprocess.run(
                 cmd, shell=True, capture_output=True, text=True, timeout=30,
@@ -246,24 +283,27 @@ def _net(value: str):
 def open_any_opted_in() -> bool:
     """Has the operator chosen to keep the port open to any source?
 
-    True for ``AGENTOS_UI_PUBLIC=1`` (public mode is unreachable otherwise) or an
-    explicit ``AGENTOS_FIREWALL_OPEN_ANY=1``. Read from the process env or
-    ``~/.agentos/.env``, like every other ``AGENTOS_UI_*`` toggle.
+    Only an explicit ``AGENTOS_FIREWALL_OPEN_ANY=1`` — read from the process env
+    or ``~/.agentos/.env``, like every other ``AGENTOS_UI_*`` toggle. (The removed
+    ``AGENTOS_UI_PUBLIC=1`` used to imply it.)
     """
     try:
-        from sdk.ui.ip_allowlist import _TRUE, _setting, public_mode
+        from sdk.ui.ip_allowlist import _TRUE, _setting
     except Exception:  # noqa: BLE001 — never fail open on an import hiccup
         return False
-    return public_mode() or _setting("AGENTOS_FIREWALL_OPEN_ANY").lower() in _TRUE
+    return _setting("AGENTOS_FIREWALL_OPEN_ANY").lower() in _TRUE
 
 
 def ensure_restricted(port: int | None = None, *, apply: bool = True,
                       ips: list[str] | None = None) -> tuple[bool, str]:
-    """Limit ``port`` to the allowlisted IPs. Returns ``(changed, message)``. Never raises.
+    """Limit ``port`` to EXACTLY the allowlisted IPs. Returns ``(changed, message)``.
+    Never raises.
 
     Adds a per-IP rule for each allowlisted address that lacks one, THEN removes
-    the open-to-any rule — in that order, and the removal is skipped if any add
-    failed, so the backend never loses its route mid-change. Same contract as
+    the open-to-any rule and every per-IP rule for an address no longer allowed
+    (only one user IP may reach the panel, so replacing it must close the old
+    one) — in that order, and the removals are skipped if any add failed, so the
+    backend never loses its route mid-change. Same contract as
     :func:`ensure_open` otherwise: unreadable state is never treated as closed,
     an unprivileged run only returns the commands, and macOS never applies.
 
@@ -291,26 +331,35 @@ def ensure_restricted(port: int | None = None, *, apply: bool = True,
                          "  sudo ufw allow OpenSSH && sudo ufw enable")
 
     if sources is None:
-        rules = allow_rules(ips, port, sysname) + [revoke_any_rule(port, sysname)]
+        rules = allow_rules(ips, port, sysname) + revoke_any_rules(port, sysname)
         printable = "  " + "\n  ".join(rules)
         ok, tool = _tool_present()
-        why = tool if not ok else "needs root to read the firewall state"
+        why = tool if not ok else "needs root or passwordless sudo to read the firewall state"
         return (False, f"could not read the firewall state ({why}) — to restrict TCP {port} "
                        f"to the allowlist yourself:\n{printable}")
 
     have = {n for n in (_net(x) for x in sources) if n is not None}
+    want = {n for n in (_net(ip) for ip in ips) if n is not None}
     missing = [ip for ip in ips if _net(ip) is not None and _net(ip) not in have]
+    stale = sorted(x for x in sources if _net(x) is not None and _net(x) not in want)
     open_any = "Anywhere" in sources
 
-    if not missing and not open_any:
+    if not missing and not open_any and not stale:
         return (False, f"TCP {port} is restricted to the allowlist" + inactive_note)
 
-    rules = allow_rules(missing, port, sysname)
-    if open_any:
-        rules.append(revoke_any_rule(port, sysname))
+    # Read ufw's exact spelling only when the deletes will run; a printed list
+    # names both forms (deleting a rule that is not there is harmless).
+    any_forms = (_ufw_any_forms(port) or [f"{port}/tcp"]) if (
+        sysname == "linux" and open_any and apply and _is_privileged()) else None
+    removals = (revoke_any_rules(port, sysname, any_forms) if open_any else []) + [
+        revoke_rule(x, port, sysname) for x in stale]
+    rules = allow_rules(missing, port, sysname) + removals
     printable = "  " + "\n  ".join(rules)
-    what = (f"TCP {port} is open to ANY source" if open_any
-            else f"TCP {port} is missing a rule for: {', '.join(missing)}")
+    what = "; ".join(w for w in (
+        f"TCP {port} is open to ANY source" if open_any else "",
+        f"missing a rule for: {', '.join(missing)}" if missing else "",
+        f"still allows: {', '.join(stale)}" if stale else "",
+    ) if w)
 
     if not apply or sysname == "darwin":
         return (False, f"{what}. To restrict it to the allowlist:\n{printable}" + inactive_note)
@@ -323,38 +372,31 @@ def ensure_restricted(port: int | None = None, *, apply: bool = True,
         # The any-rule stays: removing it now could cut the backend off.
         return (False, f"could not add allowlist rules for TCP {port}: {'; '.join(failed)}"
                        f"\nThe open-to-any rule was left in place.")
-    if open_any:
-        failed = _apply_rules([revoke_any_rule(port, sysname)])
+    if removals:
+        _apply_rules(removals)
         still = port_sources(port, sysname, collapse=False) or set()
-        if failed or "Anywhere" in still:
-            return (bool(missing), f"TCP {port} is still open to any source — a rule the SDK "
-                                   f"did not create allows it. Find and delete it:\n  "
-                                   + ("sudo ufw status numbered" if sysname == "linux" else
-                                      "netsh advfirewall firewall show rule name=all dir=in")
-                                   + inactive_note)
-        return (True, f"restricted TCP {port} to the allowlist ({len(ips)} IP(s))" + inactive_note)
-    return (True, f"added allowlist rule(s) for TCP {port}: {', '.join(missing)}" + inactive_note)
-
-
-def apply_ip(ip: str, *, add: bool = True, port: int | None = None) -> tuple[bool, str]:
-    """Add (or remove) the kernel rule for one runtime-allowlisted ``ip``. Never raises.
-
-    Called by the ``/api/ui/allowlist`` routes so a newly whitelisted IP is not
-    dropped by the host firewall until the next self-update. Applies only when
-    the panel is privileged and the port is not deliberately open to any source;
-    otherwise returns the command for the operator to run.
+        left = sorted(x for x in still
+                      if x == "Anywhere" or (_net(x) is not None and _net(x) not in want))
+        if left:
+            return (True, f"TCP {port} still allows {', '.join(left)} — a rule the SDK did "
+                          f"not create. Find and delete it:\n  "
+                          + ("sudo ufw status numbered" if sysname == "linux" else
+                             "netsh advfirewall firewall show rule name=all dir=in")
+                          + inactive_note)
+    return (True, f"restricted TCP {port} to the allowlist: {', '.join(ips)}" + inactive_note)
+
+
+def sync_rules(port: int | None = None) -> tuple[bool, str]:
+    """Bring the host firewall in line with the allowlist after it changed.
+
+    Called when the one user IP is set or cleared (CLI or panel), so the new IP's
+    rule is added and the old one's removed straight away rather than at the next
+    self-update. Leaves a deliberately open port alone. Never raises.
     """
-    port = ui_port() if port is None else port
-    sysname = _system()
-    rule = (allow_rules([ip], port, sysname)[0] if add else revoke_rule(ip, port, sysname))
     if open_any_opted_in():
-        return (False, "port is open to any source by choice — no per-IP rule needed")
-    if sysname not in ("linux", "windows") or not _is_privileged():
-        return (False, f"run on the host to update its firewall:\n  {rule}")
-    failed = _apply_rules([rule])
-    if failed:
-        return (False, f"firewall rule failed: {failed[0]}")
-    return (True, f"firewall rule {'added' if add else 'removed'} for {ip}")
+        return (False, "port is open to any source by choice (AGENTOS_FIREWALL_OPEN_ANY) — "
+                       "no per-IP rules to change")
+    return ensure_restricted(port)
 
 
 def revoke_rule(ip: str, port: int, system: str | None = None) -> str:
@@ -467,7 +509,7 @@ def port_sources(port: int, system: str | None = None, *,
     """
     sysname = (system or _system()).lower()
     if sysname == "linux":
-        text = _run(["ufw", "status"])
+        text = _run(_ufw_argv() + ["status"])
         if text is None:
             return None
         got = _parse_ufw(text, port)
@@ -488,10 +530,42 @@ def _ufw_inactive() -> bool:
     Then every ufw rule is decoration and the port is open regardless — the
     "per-IP rules are applied but the flood still arrives" case.
     """
-    text = _run(["ufw", "status"])
+    text = _run(_ufw_argv() + ["status"])
     return bool(text) and "status: inactive" in text.lower()
 
 
+def _is_root() -> bool:
+    return hasattr(os, "geteuid") and os.geteuid() == 0
+
+
+_SUDO_N: bool | None = None
+
+
+def _sudo_n_ok() -> bool:
+    """True when this (non-root, Linux) user may run ufw through ``sudo -n``.
+
+    ``agentos-auto update`` runs as the panel user, not root, so without this the
+    post-update hook could neither read nor fix ufw and only ever printed the
+    commands — the port stayed open to the world between updates. ``-n`` never
+    prompts, so an unattended update still cannot stall waiting for a password.
+    Probed once per process.
+    """
+    global _SUDO_N
+    if _SUDO_N is None:
+        _SUDO_N = False
+        if _system() == "linux" and not _is_root() and shutil.which("sudo") and shutil.which("ufw"):
+            try:
+                _SUDO_N = subprocess.run(["sudo", "-n", "ufw", "status"], capture_output=True,
+                                         text=True, timeout=10).returncode == 0
+            except Exception:  # noqa: BLE001
+                _SUDO_N = False
+    return _SUDO_N
+
+
+def _ufw_argv() -> list[str]:
+    return ["sudo", "-n", "ufw"] if _sudo_n_ok() else ["ufw"]
+
+
 def _is_privileged() -> bool:
     if _system() == "windows":
         try:
@@ -499,7 +573,7 @@ def _is_privileged() -> bool:
             return bool(ctypes.windll.shell32.IsUserAnAdmin())
         except Exception:  # noqa: BLE001 — not Windows, or no ctypes
             return False
-    return hasattr(os, "geteuid") and os.geteuid() == 0
+    return _is_root() or _sudo_n_ok()
 
 
 def cli(argv: list[str]) -> int:
@@ -572,7 +646,8 @@ def cli(argv: list[str]) -> int:
 
     rules = allow_rules(ips, port, sysname)
     if "Anywhere" in (port_sources(port, sysname) or set()):
-        rules.append(revoke_any_rule(port, sysname))
+        rules.extend(revoke_any_rules(
+            port, sysname, _ufw_any_forms(port) if sysname == "linux" else None))
         print(f"\nTCP {port} is currently open to ANY source — the last rule removes that.")
     print("\nFirewall rules for this host:\n")
     for r in rules:
@@ -607,5 +682,51 @@ def cli(argv: list[str]) -> int:
     return 0 if changed or "restricted to the allowlist" in msg else 1
 
 
+def allow_ip_cli(argv: list[str]) -> int:
+    """``agentos allow-ip [--clear]`` — show who may reach the panel, or clear the
+    outside IPs an older SDK left configured.
+
+    Since 1.7.47 no outside IP is allowed — only this machine and the DevOps Bot
+    backend — so setting one is refused with the SSH-tunnel alternative.
+    ``--clear`` empties config.toml ``allowed_ips`` and syncs the host firewall
+    (which drops their rules); ``.env`` entries are reported for the operator to
+    delete.
+    """
+    from sdk import config
+
+    def show() -> None:
+        print(f"Allowed     : this machine + DevOps Bot backend "
+              f"({', '.join(config._DEFAULT_ALLOWED_IPS)}) — no outside IP")
+        ignored = config.ignored_allowed_ips()
+        if ignored:
+            print(f"Ignored     : {', '.join(ignored)}  (outside IPs are not allowed; "
+                  "`agentos allow-ip --clear` removes them)")
+
+    args = [a for a in argv if a.strip()]
+    if not args or args[0] in ("--show", "show"):
+        show()
+        return 0
+
+    if args[0] not in ("--clear", "clear", "--remove"):
+        print("error: outside IPs can no longer be allowed — only this machine and the "
+              "DevOps Bot backend reach the panel.\n"
+              "From another computer use an SSH tunnel:\n"
+              "  ssh -L 8765:127.0.0.1:8765 <user>@<server>   then open http://127.0.0.1:8765")
+        return 2
+
+    for ip in config.runtime_allowed_ips():
+        if ip not in config._DEFAULT_ALLOWED_IPS:
+            config.remove_allowed_ip(ip)
+            print(f"✓ removed {ip} from ~/.agentos/config.toml")
+    left = config.ignored_allowed_ips()
+    if left:
+        print(f"Still in AGENTOS_UI_ALLOWED_IPS (~/.agentos/.env or the environment): "
+              f"{', '.join(left)} — ignored; delete that line to tidy up.")
+    changed, msg = sync_rules()
+    print(("↻ " if changed else "") + msg)
+    show()
+    return 0
+
+
 if __name__ == "__main__":  # pragma: no cover
     sys.exit(cli(sys.argv[1:]))