devops-bot-sdk 1.7.46__tar.gz → 1.7.47__tar.gz

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.7.46
+Version: 1.7.47
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/devops_bot_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devops-bot-sdk
-Version: 1.7.46
+Version: 1.7.47
 Summary: DevOps Bot Desktop SDK — thin client for the AgentOS Electron desktop app
 Author: noumanaziz2128
 License-Expression: LicenseRef-Proprietary

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/devops_bot_sdk.egg-info/SOURCES.txt

@@ -190,6 +190,7 @@ tests/test_allowed_tools_config.py
 tests/test_approval_park.py
 tests/test_auto_agent_dispatch.py
 tests/test_auto_ticket_queue.py
+tests/test_backend_only_allowlist.py
 tests/test_browser_profile.py
 tests/test_cheap_tier.py
 tests/test_claude_usage_gate.py
@@ -235,7 +236,6 @@ tests/test_log_colors_backlog.py
 tests/test_mcp_route_contract.py
 tests/test_memory_guard.py
 tests/test_model_policy.py
-tests/test_one_allowed_ip.py
 tests/test_panel_help.py
 tests/test_panel_ticket_schedules.py
 tests/test_parallel_tickets.py

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/sdk/__init__.py

@@ -1,6 +1,6 @@
 """AgentOS Desktop SDK — thin HTTPS/SSE client for the Electron app.
 
-Version: 1.7.46
+Version: 1.7.47
 
 Public surface:
   BackendClient.from_config()        — create client from ~/.agentos/config.toml
@@ -34,7 +34,7 @@ Rules:
   - All data egress through submit_webhook only
 """
 
-__version__ = "1.7.46"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
+__version__ = "1.7.47"   # SINGLE SOURCE OF TRUTH — bump on every change; pyproject,
 __author__  = "AgentOS"   # sdk.client.SDK_VERSION and the UI server version all read this.
 
 from sdk.client import BackendClient

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/sdk/cli.py

@@ -109,12 +109,12 @@ Command surface:
         `--any` opens the port to every source instead (not recommended: every
         scanner then reaches the panel). See sdk.firewall.
 
-    agentos allow-ip [IP | --clear]
-        Show, set or clear THE one outside IP allowed to reach the panel (besides
-        this machine and the backend). Only one at a time: a new IP replaces the
-        old one in the allowlist and the host firewall. Same-machine only — this
-        command over SSH, or the panel opened at http://127.0.0.1:8765 on the box;
-        the remote API refuses. The firewall half needs root. See sdk.firewall.
+    agentos allow-ip [--clear]
+        Show who may reach the panel: this machine and the DevOps Bot backend only
+        — no outside IP (since 1.7.47). `agentos allow-ip <IP>` is refused (exit 2)
+        with the SSH-tunnel alternative (ssh -L 8765:127.0.0.1:8765 <user>@<server>).
+        `--clear` removes outside IPs an older SDK left in config.toml and syncs the
+        host firewall (that half needs root). See sdk.firewall.
 
     agentos swagger [--open] [--json [PATH]] [--port N]
         Where the panel's Swagger UI is and whether it can actually be reached:
@@ -294,7 +294,7 @@ def _print_usage() -> None:
     print("  agentos report <submit|list|show ID>                 # report work Jira/GitHub never saw")
     print("  agentos browser <login URL|status|logout>            # sign in once; private links become readable")
     print("  agentos fallback <install|login|status|logout>       # the AI Draftsman CLI used when claude is not working")
-    print("  agentos allow-ip [IP | --clear]                     # the ONE outside IP allowed to reach the panel")
+    print("  agentos allow-ip [--clear]                          # who may reach the panel (no outside IP; use an SSH tunnel)")
     print("  agentos firewall [--apply] [--revoke IP] [--port N]  # limit the UI port to the allowlisted IPs")
     print("  agentos firewall --any [--apply]                     # open the UI port to any source (allowlist is the gate)")
     print("  agentos swagger [--open] [--json [PATH]]             # where /docs is, and can you reach it")

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/sdk/config.py

@@ -228,30 +228,18 @@ def _parse_ip_list(raw: str) -> list[str]:
 
 def get_allowed_ips() -> list[str]:
     """Client IPs permitted to reach the ``agentos-ui`` server: the built-in backend
-    IP(s) plus AT MOST ONE user IP.
-
-    ONE user IP at a time is the rule — the panel is reachable from a single
-    outside address, so a leaked token is useless anywhere else and the host
-    firewall (`sdk.firewall.ensure_restricted`) admits exactly that address.
-    Loopback and this host's own IPs are always trusted separately.
-
-    The user IP is chosen by :func:`user_allowed_ip`; anything else configured is
-    ignored and reported by :func:`ignored_allowed_ips`.
+    IP(s) and nothing else.
+
+    No outside user IP is allowed (since 1.7.47 — 1.7.46 allowed one). The panel is
+    for this machine and the DevOps Bot backend: open it on the server, or from
+    another computer through an SSH tunnel (``ssh -L 8765:127.0.0.1:8765 …``),
+    which arrives as loopback. Loopback and this host's own IPs are always trusted
+    separately. Anything still configured in ``AGENTOS_UI_ALLOWED_IPS`` or
+    config.toml ``allowed_ips`` is ignored and reported by
+    :func:`ignored_allowed_ips`; the host firewall (`sdk.firewall.ensure_restricted`)
+    removes its rule.
     """
-    out = list(_DEFAULT_ALLOWED_IPS)
-    user = user_allowed_ip()
-    if user and user not in out:
-        out.append(user)
-    return out
-
-
-def _single_address(value: str) -> bool:
-    """True for one host address (a bare IP, or a /32 / /128) — not a range."""
-    import ipaddress
-    try:
-        return ipaddress.ip_network(value.strip(), strict=False).num_addresses == 1
-    except ValueError:
-        return False
+    return list(_DEFAULT_ALLOWED_IPS)
 
 
 def _configured_user_ips() -> list[str]:
@@ -267,22 +255,9 @@ def _configured_user_ips() -> list[str]:
     return out
 
 
-def user_allowed_ip() -> str | None:
-    """The ONE user IP allowed to reach the panel, or None.
-
-    The most recent wins: the runtime entry (config.toml — set by
-    ``POST /api/ui/allowlist``) over ``.env``, and within a source the LAST entry,
-    since the documented way to add an IP is to append it. CIDR ranges are never
-    chosen — a range is many IPs.
-    """
-    candidates = [ip for ip in _configured_user_ips() if _single_address(ip)]
-    return candidates[-1] if candidates else None
-
-
 def ignored_allowed_ips() -> list[str]:
-    """Configured user IPs/ranges that are NOT allowed, because only one may be."""
-    keep = user_allowed_ip()
-    return [ip for ip in _configured_user_ips() if ip != keep]
+    """Configured outside IPs/ranges that are NOT allowed — none ever is."""
+    return _configured_user_ips()
 
 
 # Built-in baseline of tools a headless agent run may use. Kept here (not in
@@ -339,26 +314,14 @@ class PermanentAllowlistEntry(ValueError):
 
 
 def permanent_allowed_ips() -> list[str]:
-    """IPs/CIDRs whitelisted **permanently** — from ``.env`` (``~/.agentos/.env`` or
-    CWD) or the ``AGENTOS_UI_ALLOWED_IPS`` process env var.
-
-    These are the fixed baseline: they are ALWAYS allowed and **cannot be disabled**
-    through the API — change them by editing ``.env`` and restarting.
-    """
-    out: list[str] = []
-    for src in (",".join(_DEFAULT_ALLOWED_IPS),          # built-in backend IP(s) — always permanent
-                _dotenv_value("AGENTOS_UI_ALLOWED_IPS"),
-                os.environ.get("AGENTOS_UI_ALLOWED_IPS", "")):
-        for ip in _parse_ip_list(src):
-            if ip not in out:
-                out.append(ip)
-    return out
+    """The IPs that are always allowed and cannot be disabled — the built-in
+    backend IP(s). ``AGENTOS_UI_ALLOWED_IPS`` no longer adds to them (1.7.47)."""
+    return list(_DEFAULT_ALLOWED_IPS)
 
 
 def runtime_allowed_ips() -> list[str]:
-    """IPs/CIDRs whitelisted **at runtime** (config.toml ``allowed_ips``) — added by
-    the whitelist endpoint and removable by the disable endpoint. They stay in the
-    allowlist until disabled."""
+    """IPs/CIDRs left in config.toml ``allowed_ips`` by an older SDK. Ignored since
+    1.7.47 (see :func:`get_allowed_ips`); ``agentos allow-ip --clear`` removes them."""
     return _parse_ip_list(_load_raw().get("allowed_ips", ""))
 
 
@@ -461,40 +424,15 @@ def journal_enabled() -> bool:
     return flag(FLAG_JOURNAL) or tiered_routing_enabled()
 
 
-def add_allowed_ip(ip: str) -> list[str]:
-    """Make ``ip`` THE user IP at runtime (persisted to config.toml ``allowed_ips``).
-
-    Only one user IP may reach the panel at a time, so this REPLACES whichever was
-    there before — including one from ``.env``, which it outranks while set.
-    Idempotent. The middleware sees it on the next request; the caller updates the
-    host firewall. A backend IP is already allowed and is left alone. Returns the
-    effective allowlist.
-    """
-    ip = (ip or "").strip()
-    if not ip:
-        raise ValueError("ip is required")
-    if not _single_address(ip):
-        raise ValueError(f"{ip} is a range — only one IP may be allowed at a time")
-    if ip in _DEFAULT_ALLOWED_IPS:
-        return get_allowed_ips()
-    raw = _load_raw()                                   # preserves token_enc / base_url / etc.
-    raw["allowed_ips"] = ip
-    _save_raw(raw)
-    return get_allowed_ips()
-
-
 def remove_allowed_ip(ip: str) -> list[str]:
-    """Disable a RUNTIME-whitelisted IP/CIDR (remove from config.toml ``allowed_ips``).
+    """Remove a leftover entry from config.toml ``allowed_ips`` (ignored anyway).
 
-    Raises :class:`PermanentAllowlistEntry` if the IP is permanently whitelisted via
-    ``.env`` — those are never removable through the API (edit ``.env`` instead).
-    Returns the merged allowlist.
+    Raises :class:`PermanentAllowlistEntry` for a backend IP. Returns the allowlist.
     """
     ip = (ip or "").strip()
     if ip in permanent_allowed_ips():
         raise PermanentAllowlistEntry(
-            f"{ip} is permanently whitelisted via .env (AGENTOS_UI_ALLOWED_IPS) — "
-            "it cannot be disabled through the API; edit .env and restart to change it."
+            f"{ip} is a DevOps Bot backend IP — it is always allowed and cannot be removed."
         )
     raw = _load_raw()
     entries = [x for x in _parse_ip_list(raw.get("allowed_ips", "")) if x != ip]

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/sdk/faqs.py

@@ -19,19 +19,16 @@ FAQS: list[tuple[str, str, str]] = [
      "7. **Your co_ API token** — `agentos configure`\n"
      "Then `agentos doctor` checks the lot."),
     ("Basics", "How do I open the control panel from another machine?",
-     "**Easiest — an SSH tunnel (nothing to open):** on your machine run "
-     "`ssh -L 8765:127.0.0.1:8765 you@SERVER`, then browse `http://127.0.0.1:8765`.\n"
-     "**Directly by IP** — only ONE outside IP can open the panel at a time, and only someone on the "
-     "server can set it:\n"
-     "1. On YOUR machine, find your public IP: `curl -s https://api.ipify.org; echo` → prints e.g. `203.0.113.7` "
-     "(Windows PowerShell: `Invoke-RestMethod https://api.ipify.org`)\n"
-     "2. On the SERVER (over SSH): `agentos allow-ip 203.0.113.7` — this REPLACES the previous IP, which loses access. "
-     "Or open the panel on the server itself (`http://127.0.0.1:8765`) → Dashboard → **Remote access**.\n"
-     "3. If it says the firewall needs root: `sudo agentos firewall --apply` (Windows: `agentos firewall --apply` "
-     "in an Administrator PowerShell).\n"
-     "4. Browse `http://SERVER-IP:8765` and paste your co_ token. `agentos allow-ip` shows the allowed IP; "
-     "`agentos allow-ip --clear` removes it. The remote API cannot change it, so a leaked token cannot "
-     "open the panel to another address."),
+     "**Use an SSH tunnel** — no outside IP can be allowed; only the server itself and the DevOps Bot "
+     "backend reach the panel.\n"
+     "1. **Linux / macOS:** on your machine run `ssh -L 8765:127.0.0.1:8765 you@SERVER` and leave it open.\n"
+     "2. **Windows:** the same command in PowerShell (built-in OpenSSH client): "
+     "`ssh -L 8765:127.0.0.1:8765 you@SERVER`.\n"
+     "3. Browse `http://127.0.0.1:8765` on your machine — it arrives as loopback, so no IP to allow. "
+     "(Port 8765 busy locally? `ssh -L 9000:127.0.0.1:8765 …` and use `http://127.0.0.1:9000`.)\n"
+     "Or open `http://127.0.0.1:8765` on the server itself. `agentos allow-ip <IP>` is refused; "
+     "`agentos allow-ip` shows who may connect and `agentos allow-ip --clear` removes outside IPs an older "
+     "SDK left behind. A leaked token cannot open the panel to another address."),
     ("Basics", "How do I use devops-bot-sdk on another machine?",
      "Install it there too — the same checklist (Python, git, SSH key, repo access, claude or ad), then "
      "`pip install \"git+ssh://git@github.com/consultancy-outfit/DevOpsBot-SDK.git\"` and `agentos configure` "

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/sdk/firewall.py

@@ -158,6 +158,41 @@ def revoke_any_rule(port: int, system: str | None = None) -> str:
     return f"# unsupported platform {sysname!r}"
 
 
+def revoke_any_rules(port: int, system: str | None = None,
+                     forms: list[str] | None = None) -> list[str]:
+    """Every command needed to remove the open-to-any rule(s) for ``port``.
+
+    ufw keeps ``8765/tcp`` and a bare ``8765`` (tcp+udp, what a hand-typed
+    ``ufw allow 8765`` makes) as DIFFERENT rules, and deleting one leaves the other
+    — the port then stays open to everyone after ``ufw delete allow 8765/tcp``.
+    ``forms`` are the ``To`` spellings ufw shows for the Anywhere rows; unknown
+    (None) → both, since deleting a rule that does not exist is harmless.
+    """
+    sysname = (system or _system()).lower()
+    if sysname != "linux":
+        return [revoke_any_rule(port, sysname)]
+    if forms is None:
+        forms = [f"{port}/tcp", str(port)]
+    return [f"sudo ufw delete allow {f}" for f in forms]
+
+
+def _ufw_any_forms(port: int) -> list[str] | None:
+    """The ``To`` spellings of the IPv4 open-to-any rows for ``port`` (e.g.
+    ``["8765/tcp", "8765"]``), or None when ufw cannot be read."""
+    text = _run(_ufw_argv() + ["status"])
+    if text is None:
+        return None
+    out: list[str] = []
+    for line in text.splitlines():
+        parts = line.split("#", 1)[0].split()
+        if (len(parts) >= 3 and "(v6)" not in line and parts[1].upper() == "ALLOW"
+                and parts[-1] == "Anywhere"
+                and (parts[0] == str(port) or parts[0].startswith(f"{port}/"))
+                and parts[0] not in out):
+            out.append(parts[0])
+    return out
+
+
 def ensure_open(port: int | None = None, *, apply: bool = True) -> tuple[bool, str]:
     """Make sure ``port`` is reachable. Returns ``(changed, message)``. Never raises.
 
@@ -197,7 +232,7 @@ def ensure_open(port: int | None = None, *, apply: bool = True) -> tuple[bool, s
         return (False, f"macOS: pf state is not readable and pf rules are file-based —\n{printable}")
     if sources is None:
         ok, tool = _tool_present()
-        why = tool if not ok else "needs root to read the firewall state"
+        why = tool if not ok else "needs root or passwordless sudo to read the firewall state"
         return (False, f"could not read the firewall state ({why}) — to open it yourself:\n{printable}")
 
     # Readable and genuinely empty for this port.
@@ -214,13 +249,16 @@ def ensure_open(port: int | None = None, *, apply: bool = True) -> tuple[bool, s
 
 
 def _apply_rules(rules: list[str]) -> list[str]:
-    """Run each rule (already privileged, so a printed ``sudo `` is stripped).
+    """Run each rule. As root a printed ``sudo `` is stripped; otherwise it becomes
+    ``sudo -n `` (passwordless sudo — see :func:`_sudo_n_ok`), which fails instead
+    of waiting for a password.
 
     Returns one ``"<cmd>: <reason>"`` per failure — empty means all applied.
     """
+    prefix = "sudo -n " if _sudo_n_ok() else ""
     failed: list[str] = []
     for rule in rules:
-        cmd = rule[len("sudo "):] if rule.startswith("sudo ") else rule
+        cmd = prefix + rule[len("sudo "):] if rule.startswith("sudo ") else rule
         try:
             proc = subprocess.run(
                 cmd, shell=True, capture_output=True, text=True, timeout=30,
@@ -293,10 +331,10 @@ def ensure_restricted(port: int | None = None, *, apply: bool = True,
                          "  sudo ufw allow OpenSSH && sudo ufw enable")
 
     if sources is None:
-        rules = allow_rules(ips, port, sysname) + [revoke_any_rule(port, sysname)]
+        rules = allow_rules(ips, port, sysname) + revoke_any_rules(port, sysname)
         printable = "  " + "\n  ".join(rules)
         ok, tool = _tool_present()
-        why = tool if not ok else "needs root to read the firewall state"
+        why = tool if not ok else "needs root or passwordless sudo to read the firewall state"
         return (False, f"could not read the firewall state ({why}) — to restrict TCP {port} "
                        f"to the allowlist yourself:\n{printable}")
 
@@ -309,7 +347,11 @@ def ensure_restricted(port: int | None = None, *, apply: bool = True,
     if not missing and not open_any and not stale:
         return (False, f"TCP {port} is restricted to the allowlist" + inactive_note)
 
-    removals = ([revoke_any_rule(port, sysname)] if open_any else []) + [
+    # Read ufw's exact spelling only when the deletes will run; a printed list
+    # names both forms (deleting a rule that is not there is harmless).
+    any_forms = (_ufw_any_forms(port) or [f"{port}/tcp"]) if (
+        sysname == "linux" and open_any and apply and _is_privileged()) else None
+    removals = (revoke_any_rules(port, sysname, any_forms) if open_any else []) + [
         revoke_rule(x, port, sysname) for x in stale]
     rules = allow_rules(missing, port, sysname) + removals
     printable = "  " + "\n  ".join(rules)
@@ -467,7 +509,7 @@ def port_sources(port: int, system: str | None = None, *,
     """
     sysname = (system or _system()).lower()
     if sysname == "linux":
-        text = _run(["ufw", "status"])
+        text = _run(_ufw_argv() + ["status"])
         if text is None:
             return None
         got = _parse_ufw(text, port)
@@ -488,10 +530,42 @@ def _ufw_inactive() -> bool:
     Then every ufw rule is decoration and the port is open regardless — the
     "per-IP rules are applied but the flood still arrives" case.
     """
-    text = _run(["ufw", "status"])
+    text = _run(_ufw_argv() + ["status"])
     return bool(text) and "status: inactive" in text.lower()
 
 
+def _is_root() -> bool:
+    return hasattr(os, "geteuid") and os.geteuid() == 0
+
+
+_SUDO_N: bool | None = None
+
+
+def _sudo_n_ok() -> bool:
+    """True when this (non-root, Linux) user may run ufw through ``sudo -n``.
+
+    ``agentos-auto update`` runs as the panel user, not root, so without this the
+    post-update hook could neither read nor fix ufw and only ever printed the
+    commands — the port stayed open to the world between updates. ``-n`` never
+    prompts, so an unattended update still cannot stall waiting for a password.
+    Probed once per process.
+    """
+    global _SUDO_N
+    if _SUDO_N is None:
+        _SUDO_N = False
+        if _system() == "linux" and not _is_root() and shutil.which("sudo") and shutil.which("ufw"):
+            try:
+                _SUDO_N = subprocess.run(["sudo", "-n", "ufw", "status"], capture_output=True,
+                                         text=True, timeout=10).returncode == 0
+            except Exception:  # noqa: BLE001
+                _SUDO_N = False
+    return _SUDO_N
+
+
+def _ufw_argv() -> list[str]:
+    return ["sudo", "-n", "ufw"] if _sudo_n_ok() else ["ufw"]
+
+
 def _is_privileged() -> bool:
     if _system() == "windows":
         try:
@@ -499,7 +573,7 @@ def _is_privileged() -> bool:
             return bool(ctypes.windll.shell32.IsUserAnAdmin())
         except Exception:  # noqa: BLE001 — not Windows, or no ctypes
             return False
-    return hasattr(os, "geteuid") and os.geteuid() == 0
+    return _is_root() or _sudo_n_ok()
 
 
 def cli(argv: list[str]) -> int:
@@ -572,7 +646,8 @@ def cli(argv: list[str]) -> int:
 
     rules = allow_rules(ips, port, sysname)
     if "Anywhere" in (port_sources(port, sysname) or set()):
-        rules.append(revoke_any_rule(port, sysname))
+        rules.extend(revoke_any_rules(
+            port, sysname, _ufw_any_forms(port) if sysname == "linux" else None))
         print(f"\nTCP {port} is currently open to ANY source — the last rule removes that.")
     print("\nFirewall rules for this host:\n")
     for r in rules:
@@ -608,55 +683,45 @@ def cli(argv: list[str]) -> int:
 
 
 def allow_ip_cli(argv: list[str]) -> int:
-    """``agentos allow-ip [IP | --clear]`` — set, show or clear THE one user IP.
-
-    Only one outside IP may reach the panel at a time; setting a new one replaces
-    the old one in the allowlist and in the host firewall. This command is one of
-    the two ways to change it — both need someone on the machine (this one over
-    SSH, or the panel opened at http://127.0.0.1:8765 on the box); the remote API
-    refuses. Run it as the user the panel runs as, so it edits that user's
-    ~/.agentos/config.toml; the firewall half needs root and prints the command
-    otherwise.
+    """``agentos allow-ip [--clear]`` — show who may reach the panel, or clear the
+    outside IPs an older SDK left configured.
+
+    Since 1.7.47 no outside IP is allowed — only this machine and the DevOps Bot
+    backend — so setting one is refused with the SSH-tunnel alternative.
+    ``--clear`` empties config.toml ``allowed_ips`` and syncs the host firewall
+    (which drops their rules); ``.env`` entries are reported for the operator to
+    delete.
     """
     from sdk import config
 
     def show() -> None:
-        user = config.user_allowed_ip()
-        print(f"Allowed user IP : {user or '(none — only this machine and the backend)'}")
-        print(f"Backend IPs     : {', '.join(config._DEFAULT_ALLOWED_IPS)}")
+        print(f"Allowed     : this machine + DevOps Bot backend "
+              f"({', '.join(config._DEFAULT_ALLOWED_IPS)}) — no outside IP")
         ignored = config.ignored_allowed_ips()
         if ignored:
-            print(f"Ignored         : {', '.join(ignored)}  (only one user IP is allowed at a time)")
+            print(f"Ignored     : {', '.join(ignored)}  (outside IPs are not allowed; "
+                  "`agentos allow-ip --clear` removes them)")
 
     args = [a for a in argv if a.strip()]
     if not args or args[0] in ("--show", "show"):
         show()
         return 0
 
-    if args[0] in ("--clear", "clear", "--remove"):
-        user = config.user_allowed_ip()
-        runtime = [ip for ip in config.runtime_allowed_ips() if ip == user]
-        if not runtime:
-            if user:
-                print(f"{user} comes from AGENTOS_UI_ALLOWED_IPS in ~/.agentos/.env — "
-                      "remove it there.")
-                return 1
-            print("No user IP is allowed — nothing to clear.")
-            return 0
-        config.remove_allowed_ip(user)
-        print(f"✓ removed {user}")
-    else:
-        ip = args[0]
-        before = config.user_allowed_ip()
-        try:
-            config.add_allowed_ip(ip)
-        except ValueError as exc:
-            print(f"error: {exc}")
-            return 2
-        print(f"✓ {ip} is now the one IP allowed to reach the panel")
-        if before and before != ip:
-            print(f"  (replaced {before} — it no longer has access)")
-
+    if args[0] not in ("--clear", "clear", "--remove"):
+        print("error: outside IPs can no longer be allowed — only this machine and the "
+              "DevOps Bot backend reach the panel.\n"
+              "From another computer use an SSH tunnel:\n"
+              "  ssh -L 8765:127.0.0.1:8765 <user>@<server>   then open http://127.0.0.1:8765")
+        return 2
+
+    for ip in config.runtime_allowed_ips():
+        if ip not in config._DEFAULT_ALLOWED_IPS:
+            config.remove_allowed_ip(ip)
+            print(f"✓ removed {ip} from ~/.agentos/config.toml")
+    left = config.ignored_allowed_ips()
+    if left:
+        print(f"Still in AGENTOS_UI_ALLOWED_IPS (~/.agentos/.env or the environment): "
+              f"{', '.join(left)} — ignored; delete that line to tidy up.")
     changed, msg = sync_rules()
     print(("↻ " if changed else "") + msg)
     show()

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/sdk/help_data/areas.json

@@ -1,12 +1,12 @@
 [
  {
   "area": "Control panel",
-  "changes_30d": 7,
+  "changes_30d": 8,
   "features_30d": 2,
   "fixes_30d": 1,
-  "latest": "security: restrict panel port to the allowlist, cheap refusals, auth-failure bans, connection cap",
-  "latest_pr": 188,
-  "latest_date": "2026-10-29"
+  "latest": "security: backend-only panel allowlist; firewall removes bare 8765 rule, uses sudo -n",
+  "latest_pr": 190,
+  "latest_date": "2026-10-30"
  },
  {
   "area": "Help",

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/sdk/help_data/commands.json

@@ -511,10 +511,10 @@
  },
  {
   "command": "agentos allow-ip",
-  "syntax": "agentos allow-ip [IP | --clear]",
+  "syntax": "agentos allow-ip [--clear]",
   "program": "agentos",
   "area": "Other",
-  "description": "the ONE outside IP allowed to reach the panel (on the server only)",
+  "description": "who may reach the panel (no outside IP); --clear removes leftover ones",
   "valid": true,
   "doc": "https://github.com/consultancy-outfit/DevOpsBot-SDK/blob/main/docs/COMMANDS.md",
   "id": "agentos allow-ip"

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/sdk/help_data/help.json

@@ -57,7 +57,7 @@
  },
  {
   "issue": "After `agentos-auto update`: \"no systemd unit 'agentos-ui' — restart the panel manually\", \"could not read the firewall state (needs root …) … sudo ufw allow 8765/tcp\", \"VPS health: not reported — not_assigned_vps\"",
-  "fix": "Not errors. The update restarts the panel so it runs the new code (`sdk/ui/service.py`), limits the panel's port to the allowed IPs — the backend and the one outside IP; it removes any open-to-everyone rule (`sdk/firewall.py` `ensure_restricted` — it never runs sudo itself, so unprivileged it prints the commands instead), and reports VPS health only from the VPS assigned to the account (`sdk/vps_health.py`). On a laptop or any machine that is not the assigned VPS all three are expected and need no action; on the VPS, run `sudo agentos firewall --apply`, and restart `agentos-ui` if it runs by hand. \"ufw is INACTIVE\" in that output means no rule is enforced at all: `sudo ufw allow OpenSSH && sudo ufw enable`."
+  "fix": "Not errors. The update restarts the panel so it runs the new code (`sdk/ui/service.py`), limits the panel's port to the backend IPs; it removes any open-to-everyone rule — both `8765/tcp` and a bare `ufw allow 8765` — and the rules of ignored outside IPs (`sdk/firewall.py` `ensure_restricted` — not root, it tries passwordless `sudo -n`; without that it prints `sudo ufw delete allow 8765/tcp` / `sudo ufw delete allow 8765` instead), and reports VPS health only from the VPS assigned to the account (`sdk/vps_health.py`). On a laptop or any machine that is not the assigned VPS all three are expected and need no action; on the VPS, run `sudo agentos firewall --apply`, and restart `agentos-ui` if it runs by hand. \"ufw is INACTIVE\" in that output means no rule is enforced at all: `sudo ufw allow OpenSSH && sudo ufw enable`."
  },
  {
   "issue": "Panel at 100% CPU / slow, lots of 403s or unknown IPs in `ss -tn sport = :8765`",

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/sdk/help_data/pages.json

@@ -3,7 +3,7 @@
   "page": "Dashboard",
   "file": "index.html",
   "heading": "Daily ticket activity",
-  "summary": "Bot — waiting for work To Do— In Progress— Done— Backlog— Daily ticket activity 7 days 30 days To Do In Progress Done Backlog Up next0 Remote access Allowed IP: —"
+  "summary": "Bot — waiting for work To Do— In Progress— Done— Backlog— Daily ticket activity 7 days 30 days To Do In Progress Done Backlog Up next0 Remote access Allowed: this server + DevOps Bot backend"
  },
  {
   "page": "Run & Logs",

{devops_bot_sdk-1.7.46 → devops_bot_sdk-1.7.47}/sdk/help_data/releases.json

@@ -1,4 +1,14 @@
 [
+ {
+  "pr": 190,
+  "date": "2026-10-30",
+  "merged_at": "2026-10-30T14:48:32+05:00",
+  "type": "Other",
+  "area": "Control panel",
+  "title": "security: backend-only panel allowlist; firewall removes bare 8765 rule, uses sudo -n",
+  "version": "1.7.47",
+  "url": "https://github.com/consultancy-outfit/DevOpsBot-SDK/pull/190"
+ },
  {
   "pr": 189,
   "date": "2026-10-30",

devops_bot_sdk-1.7.47/sdk/help_data/snapshot.json

@@ -0,0 +1,17 @@
+[
+ {
+  "version": "1.7.47",
+  "commit": "226a619",
+  "pushed_at": "2026-10-30T14:48:32+05:00",
+  "generated_at": "2026-10-30T09:50:43+00:00",
+  "commands": 59,
+  "commands_invalid": 0,
+  "commands_undocumented": 0,
+  "panel_pages": 11,
+  "tests": 2600,
+  "prs_7d": 26,
+  "prs_30d": 42,
+  "features_30d": 12,
+  "fixes_30d": 18
+ }
+]