fix(daemon): refuse host path install sources on the HTTP surface (#2102)

* fix(daemon): refuse host path install sources on the HTTP surface

`install_from_source` accepted `source.kind: "path"` over `/rpc` behind nothing
but a non-empty check, so any caller who could reach the daemon with a valid
token could name a file the daemon user can read and have its bytes flow back
through the install pipeline.

The `url` kind already declares its trust boundary (credential rejection,
blocked hostnames, non-public-address rejection, redirect caps). The `path`
kind has no host-side equivalent, and it does not need one: it is a local
affordance for callers that already carry the daemon's own authority, so the
HTTP boundary refuses it outright instead of confining it.

`HttpInstallSource` carries the narrowed contract, so a path source cannot be
returned from the boundary again without failing to compile.

In-process callers are untouched — `admin.ts` and `diff-screenshot.ts` build
path sources without crossing `parseInstallSource`.

Refs #2097

* fix(daemon): refuse host path install sources through the remote proxy

The `parseInstallSource` gate covered one of the two RPC methods that can carry
an install source. The generic `agent_device.command` method copies `params.meta`
wholesale and `commandRpcParamsSchema` types `meta` as an opaque object, so
`meta.installSource` reached the install handler unparsed — and that is the
method the client actually uses.

Gating it at the daemon's HTTP boundary would take local callers with it: that
server binds loopback, and `agent-device proxy` puts the local daemon in HTTP
mode, so a local `install <path>` on a proxy host crosses the same boundary with
the same wire shape. The proxy is the seam that separates the daemon's host from
callers who are not on it, so the refusal belongs there — where it also covers
both RPC methods at once, because the proxy reads the body before the method.

An uploaded artifact still backs a path source across the proxy: the daemon
substitutes the uploaded file and never reads the wire path, and an upload id
the caller does not own throws rather than falling back to it. That fallback is
what would turn the carve-out into the hole, so it is now pinned by a test.

This refuses `install remote:<path>` through a proxy. Naming a file on the
daemon's host from a remote client is the reported vulnerability, so the
affordance cannot survive the fix; the client-side prefix is left in place.

Refs #2097

* refactor(proxy): give the host-path refusal its own module

Review: the narration I added carried what names, a module boundary, and test
names should carry, and `daemon-proxy.ts` had held no such comments before.

`proxy-install-source-admission.ts` now owns the rule, so the boundary states
it instead of a comment; `isBackedByUploadedArtifact` names what "unbacked"
means in `carriesUnbackedHostPathInstallSource`. The proxy owner returns to 443
lines from 495.

Refs #2097

Author: thymikee

src/__tests__/daemon-proxy.test.ts

@@ -513,3 +513,129 @@ function sendUploadProxyFinalize(
   res.setHeader('content-type', 'application/json');
   res.end(JSON.stringify({ ok: true, uploadId: 'tracked-upload-1' }));
 }
+
+type ProxyRpcOutcome = {
+  status: number;
+  body: { error?: { code?: number; message?: string; data?: { code?: string } } };
+  upstreamCalls: number;
+};
+
+async function postInstallRpcThroughProxy(
+  params: Record<string, unknown>,
+): Promise<ProxyRpcOutcome> {
+  let upstreamCalls = 0;
+  const upstream = http.createServer((req, res) => {
+    upstreamCalls += 1;
+    let body = '';
+    req.setEncoding('utf8');
+    req.on('data', (chunk) => {
+      body += chunk;
+    });
+    req.on('end', () => {
+      res.setHeader('content-type', 'application/json');
+      res.end(
+        JSON.stringify({
+          jsonrpc: '2.0',
+          id: (JSON.parse(body) as { id?: unknown }).id,
+          result: { ok: true, data: { reached: 'upstream' } },
+        }),
+      );
+    });
+  });
+  const proxy = createDaemonProxyServer({
+    upstreamBaseUrl: `http://127.0.0.1:${await listenOnLoopback(upstream)}`,
+    upstreamToken: 'daemon-secret',
+    clientToken: 'proxy-secret',
+  });
+
+  try {
+    const proxyPort = await listenOnLoopback(proxy);
+    const response = await fetch(`http://127.0.0.1:${proxyPort}/agent-device/rpc`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', authorization: 'Bearer proxy-secret' },
+      body: JSON.stringify({ jsonrpc: '2.0', id: 'req-1', ...params }),
+    });
+    return {
+      status: response.status,
+      body: (await response.json()) as ProxyRpcOutcome['body'],
+      upstreamCalls,
+    };
+  } finally {
+    await closeLoopbackServer(proxy);
+    await closeLoopbackServer(upstream);
+  }
+}
+
+test('proxy refuses a host path install source on the generic command method', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+
+  const { status, body, upstreamCalls } = await postInstallRpcThroughProxy({
+    method: 'agent_device.command',
+    params: {
+      token: 'proxy-secret',
+      command: 'install_source',
+      positionals: [],
+      flags: { platform: 'android' },
+      meta: { installSource: { kind: 'path', path: '/etc/passwd' } },
+    },
+  });
+
+  assert.equal(status, 400);
+  assert.equal(body.error?.code, -32602);
+  assert.equal(body.error?.data?.code, 'INVALID_ARGS');
+  assert.equal(upstreamCalls, 0, 'the daemon must never see a proxied host path source');
+});
+
+test('proxy refuses a host path install source on the install_from_source method', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+
+  const { status, body, upstreamCalls } = await postInstallRpcThroughProxy({
+    method: 'agent_device.install_from_source',
+    params: {
+      token: 'proxy-secret',
+      platform: 'android',
+      source: { kind: 'path', path: '/etc/passwd' },
+    },
+  });
+
+  assert.equal(status, 400);
+  assert.equal(body.error?.data?.code, 'INVALID_ARGS');
+  assert.equal(upstreamCalls, 0);
+});
+
+test('proxy forwards a path source backed by an uploaded artifact', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+
+  const { status, upstreamCalls } = await postInstallRpcThroughProxy({
+    method: 'agent_device.command',
+    params: {
+      token: 'proxy-secret',
+      command: 'install_source',
+      positionals: [],
+      flags: { platform: 'android' },
+      meta: {
+        installSource: { kind: 'path', path: '/Users/dev/Downloads/Sample.apk' },
+        uploadedArtifactId: 'upload-1',
+      },
+    },
+  });
+
+  assert.equal(status, 200);
+  assert.equal(upstreamCalls, 1);
+});
+
+test('proxy forwards url install sources unchanged', async (t) => {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+
+  const { status, upstreamCalls } = await postInstallRpcThroughProxy({
+    method: 'agent_device.install_from_source',
+    params: {
+      token: 'proxy-secret',
+      platform: 'android',
+      source: { kind: 'url', url: 'https://example.com/app.apk' },
+    },
+  });
+
+  assert.equal(status, 200);
+  assert.equal(upstreamCalls, 1);
+});

src/daemon/__tests__/http-server-rpc-validation.test.ts

@@ -127,3 +127,86 @@ test('the rpc boundary never accepts internal request fields from the wire', asy
     await closeLoopbackServer(server);
   }
 });
+
+async function withInstallFromSourceRpcServer(
+  run: (
+    post: (source: unknown) => Promise<{
+      status: number;
+      body: RpcErrorResponse;
+      dispatched: DaemonRequest[];
+    }>,
+  ) => Promise<void>,
+  t: { skip(reason?: string): void },
+): Promise<void> {
+  if (await skipWhenLoopbackUnavailable(t)) return;
+
+  const dispatched: DaemonRequest[] = [];
+  const handleRequest = async (req: DaemonRequest): Promise<DaemonResponse> => {
+    dispatched.push(req);
+    return { ok: true, data: { ok: true } };
+  };
+  const server = await createDaemonHttpServer({ handleRequest });
+
+  try {
+    const port = await listenOnLoopback(server);
+    const post = async (source: unknown) => {
+      const response = await fetch(`http://127.0.0.1:${port}/rpc`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          jsonrpc: '2.0',
+          id: 'req-1',
+          method: 'agent_device.install_from_source',
+          params: { platform: 'android', source },
+        }),
+      });
+      return {
+        status: response.status,
+        body: (await response.json()) as RpcErrorResponse,
+        dispatched,
+      };
+    };
+    await run(post);
+  } finally {
+    await closeLoopbackServer(server);
+  }
+}
+
+test('install_from_source rejects a host path source at the rpc boundary', async (t) => {
+  await withInstallFromSourceRpcServer(async (post) => {
+    const { status, body, dispatched } = await post({ kind: 'path', path: '/etc/passwd' });
+
+    assert.equal(status, 400);
+    assert.equal(body.error?.code, -32602);
+    assert.equal(body.error?.data?.code, 'INVALID_ARGS');
+    assert.equal(dispatched.length, 0, 'a host path source must never reach the handler');
+  }, t);
+});
+
+test('install_from_source still admits url sources', async (t) => {
+  await withInstallFromSourceRpcServer(async (post) => {
+    const { status, dispatched } = await post({ kind: 'url', url: 'https://example.com/app.apk' });
+
+    assert.equal(status, 200);
+    assert.equal(dispatched.length, 1);
+    assert.deepEqual(dispatched[0]?.meta?.installSource, {
+      kind: 'url',
+      url: 'https://example.com/app.apk',
+    });
+  }, t);
+});
+
+test('install_from_source still admits github-actions-artifact sources', async (t) => {
+  await withInstallFromSourceRpcServer(async (post) => {
+    const { status, dispatched } = await post({
+      kind: 'github-actions-artifact',
+      owner: 'callstack',
+      repo: 'agent-device',
+      artifactId: 42,
+    });
+
+    assert.equal(status, 200);
+    assert.equal(dispatched.length, 1);
+    assert.equal(dispatched[0]?.meta?.installSource?.kind, 'github-actions-artifact');
+  }, t);
+});

src/daemon/__tests__/install-source-resolution.test.ts

@@ -76,3 +76,14 @@ test('resolveInstallSource rejects GitHub Actions artifact sources on the local
     ),
   ).toThrow(/compatible remote daemon/i);
 });
+
+test('resolveInstallSource refuses an unknown upload id rather than reading the wire path', () => {
+  expect(() =>
+    resolveInstallSource(
+      makeRequest({
+        uploadedArtifactId: 'not-a-real-upload',
+        installSource: { kind: 'path', path: '/etc/passwd' },
+      }),
+    ),
+  ).toThrow();
+});

src/daemon/server/http-server.ts

@@ -76,6 +76,8 @@ type HttpAuthDecision =
   | { ok: true; tenantId?: string }
   | { ok: false; statusCode: number; response: JsonRpcResponse };
 
+type HttpInstallSource = Exclude<DaemonInstallSource, { kind: 'path' }>;
+
 const MAX_HTTP_RPC_BODY_BYTES = 1024 * 1024;
 const COMMAND_RPC_METHODS = new Set(['agent_device.command', 'agent-device.command']);
 const INSTALL_FROM_SOURCE_RPC_METHODS = new Set([
@@ -219,7 +221,7 @@ function readGitHubArtifactInteger(record: Record<string, unknown>, key: 'artifa
   return parsed;
 }
 
-function parseGitHubActionsArtifactSource(record: Record<string, unknown>): DaemonInstallSource {
+function parseGitHubActionsArtifactSource(record: Record<string, unknown>): HttpInstallSource {
   const owner = readRequiredGitHubArtifactText(record, 'owner');
   const repo = readRequiredGitHubArtifactText(record, 'repo');
   const hasArtifactId = record.artifactId !== undefined;
@@ -288,7 +290,7 @@ function toLeaseDaemonRequest(
   };
 }
 
-function parseInstallSource(params: Record<string, unknown>): DaemonInstallSource {
+function parseInstallSource(params: Record<string, unknown>): HttpInstallSource {
   const source = params.source;
   if (!source || typeof source !== 'object') {
     throw new AppError('INVALID_ARGS', 'Invalid params: source is required');
@@ -318,21 +320,18 @@ function parseInstallSource(params: Record<string, unknown>): DaemonInstallSourc
     return Object.keys(headers).length > 0 ? { kind: 'url', url, headers } : { kind: 'url', url };
   }
   if (record.kind === 'path') {
-    const artifactPath = typeof record.path === 'string' ? record.path.trim() : '';
-    if (!artifactPath) {
-      throw new AppError(
-        'INVALID_ARGS',
-        'Invalid params: source.path is required for path sources',
-      );
-    }
-    return { kind: 'path', path: artifactPath };
+    throw new AppError(
+      'INVALID_ARGS',
+      'Invalid params: source.kind "path" names a file on the daemon host and is not accepted over HTTP',
+      { hint: 'Use a "url" or "github-actions-artifact" source.' },
+    );
   }
   if (record.kind === 'github-actions-artifact') {
     return parseGitHubActionsArtifactSource(record);
   }
   throw new AppError(
     'INVALID_ARGS',
-    'Invalid params: source.kind must be "url", "path", or "github-actions-artifact"',
+    'Invalid params: source.kind must be "url" or "github-actions-artifact"',
   );
 }
 

src/remote/daemon-proxy.ts

@@ -12,6 +12,10 @@ import {
   buildDaemonHttpUrl,
 } from '../daemon/http-contract.ts';
 import { buildDaemonHealthPayload } from '../daemon/http-health.ts';
+import {
+  carriesUnbackedHostPathInstallSource,
+  sendHostPathInstallSourceRefused,
+} from './proxy-install-source-admission.ts';
 
 export type DaemonProxyOptions = {
   upstreamBaseUrl: string;
@@ -80,6 +84,11 @@ async function handleProxyRequest(
     return;
   }
 
+  if (carriesUnbackedHostPathInstallSource(rpcBody)) {
+    sendHostPathInstallSourceRefused(res, readJsonRpcId(rpcBody));
+    return;
+  }
+
   await forwardProxyRequest({ req, res, route, options, rpcBody });
 }
 

src/remote/proxy-install-source-admission.ts

@@ -0,0 +1,51 @@
+import type { ServerResponse } from 'node:http';
+import { AppError, normalizeError } from '@agent-device/kernel/errors';
+
+export function carriesUnbackedHostPathInstallSource(rpcBody: string | undefined): boolean {
+  const params = readRpcParams(rpcBody);
+  if (!params) return false;
+  const meta = readRecord(params.meta);
+  if (isBackedByUploadedArtifact(meta)) return false;
+  return isHostPathInstallSource(params.source) || isHostPathInstallSource(meta?.installSource);
+}
+
+export function sendHostPathInstallSourceRefused(res: ServerResponse, rpcId: unknown): void {
+  const error = new AppError(
+    'INVALID_ARGS',
+    'Invalid params: an install source of kind "path" names a file on the daemon host and is not accepted through the proxy',
+    { hint: 'Upload the artifact, or use a "url" or "github-actions-artifact" source.' },
+  );
+  res.statusCode = 400;
+  res.setHeader('content-type', 'application/json');
+  res.end(
+    JSON.stringify({
+      jsonrpc: '2.0',
+      id: rpcId,
+      error: { code: -32602, message: error.message, data: normalizeError(error) },
+    }),
+  );
+}
+
+function readRpcParams(rpcBody: string | undefined): Record<string, unknown> | undefined {
+  if (!rpcBody) return undefined;
+  try {
+    return readRecord(readRecord(JSON.parse(rpcBody))?.params);
+  } catch {
+    return undefined;
+  }
+}
+
+function isBackedByUploadedArtifact(meta: Record<string, unknown> | undefined): boolean {
+  const uploadedArtifactId = meta?.uploadedArtifactId;
+  return typeof uploadedArtifactId === 'string' && uploadedArtifactId.trim().length > 0;
+}
+
+function isHostPathInstallSource(source: unknown): boolean {
+  return readRecord(source)?.kind === 'path';
+}
+
+function readRecord(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}