Files
skills/orchestrator/kvb_orchestrator/view.py
T
Kevin Veen-BirkenbachandClaude Opus 5.5 ba97f7cc2e fix(orchestrator): release a station's redirect targets in media-src
Deutschlandfunk stayed silent: its signed URL answers 302 to
f111.rndfnk.com, an origin the signed media-src never listed, so the
browser blocked the redirected load and reported only the station's own
URL in securitypolicyviolation.

The hub now resolves each https stream's redirect chain server side when
a settings save adds or changes it and stores the extra origins as the
stream's via list. media-src lists them next to the signed origins. A CDN
host of three or more labels widens to its siblings (*.rndfnk.com); an
IP, a two-label host and a name under a country code's generic second
level stay exact.

Hardening:

- Only the signed URL itself may lie at a non-global address; every
  redirect hop dials a global address only, checked on the address
  actually dialed (NAT64 and IPv4-compatible IPv6 count by the embedded
  IPv4 address).
- A resolve answers within three socket timeouts even for a server that
  drips its headers; a late probe goes on in a daemon thread and a url
  still in flight is not probed twice.
- A failed resolution stores via null and retries on a save ten minutes
  later; the radio page says so instead of blaming the CSP.
- A save whose settings changed while it was resolved fails instead of
  overwriting them (compare and set under the settings lock).
- A new stream URL at an already signed origin takes the passkey too.
- Settings written before via existed load as via [] and never dial.

Residuals:

- The passkey proof is spent before the resolve, so a save racing
  another one fails and the operator signs again.
- A save that hits a due retry blocks up to twelve seconds and may
  reload the page.
- A page loaded before the upgrade throws on the missing via until it
  reloads.
- A private multi-tenant suffix such as github.io still widens.
- getaddrinfo has no timeout; it runs inside the daemon thread.

Operator step after install: remove Deutschlandfunk in Radio, Sender
bearbeiten, save, add it again and save with the passkey.

🎯 Fix: 92 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 88
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-08 10:23:32 +00:00

205 lines
9.6 KiB
Python

from __future__ import annotations
import time
from .asking import ask_row, decision_row
from .council import (
MAYDAY_ACTIVE,
NEWS,
grants,
night_mode,
radio_rows,
read_claims,
sessions,
silence_of,
)
from .crons import queue_entries
from .errors import ToolError
from .events import KINDS, VIEWS
from .fields import decode, instant, single
from .graph import graph
from .jobs import JOB_OPEN
from .messaging import message_row
from .orbits import TRACK_STEPS, track
from .phrasing import phrase
from .records import epoch, iso_epoch, read_jsonl
from .register import (
AGENT_ORDER,
REGISTER,
agent_order,
operator_rows,
read_register,
register_rows,
stored_order,
)
from .reviewing import review_row
from .settings import media_origins, station_origins, valid_settings
from .signed import signing
from .skill_scripts import OUTPUT_LIMIT
from .tasks import task_rows
RADIO_WINDOW = 86400
JOBS_SHOWN = 20
ACTIVE = 900
INDEX_CSP = (
"default-src 'none'; script-src 'nonce-{0}'; style-src 'nonce-{0}'; connect-src 'self'; media-src {1}; "
"base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
)
def badges(inbox: list[dict], claims: list[dict], jobs: list[dict], now: float) -> dict[str, int]:
return {
"inbox": sum(1 for item in inbox if not item["until"]),
"agents": len({claim["agent"] for claim in claims if claim["beat"] is not None and claim["beat"] >= now - ACTIVE}),
"artifacts": sum(1 for job in jobs if job["status"] in JOB_OPEN),
}
class View:
def span(self, query: dict[str, list[str]], now: float) -> tuple[float, float]:
end = instant(query, "to")
end = now if end is None else min(end, now)
begin = instant(query, "from")
begin = end - RADIO_WINDOW if begin is None else begin
if begin > end:
raise ToolError("from must not lie after to")
return begin, end
def window(self, query: dict[str, list[str]]) -> dict:
now = time.time()
begin, end = self.span(query, now)
sampled = single(query, "track")
if sampled not in (None, "1"):
raise ToolError("track must be 1 or left out")
self.tree.beat()
return self.state(begin, end, now, TRACK_STEPS if sampled else 0)
def first(self, news: list[dict], history: list[dict], claims: list[dict], now: float) -> float:
moments = [epoch(row.get("ts")) for row in news] + [epoch(row.get("start")) for row in history]
moments += [iso_epoch(claim["since"]) for claim in claims] + [self.transcripts.first()]
moments += [iso_epoch(record["created"]) for ledger in (self.reviews, self.asks, self.decisions, self.messages) for record in ledger.listed()]
return min([now, *(moment for moment in moments if moment is not None)])
def state(self, begin: float, end: float, now: float, steps: int) -> dict:
tasks = read_register(self.council / REGISTER)
news = read_jsonl(self.council / NEWS)
history = read_jsonl(self.council / "queue-history.jsonl")
claims = read_claims(self.council)
names = sessions(claims)
directory = self.directory(claims, news, now)
radio = []
for row in radio_rows(news, begin, end):
source = directory.key(row["from"], row["ts"])
targets = [directory.key(name, row["ts"]) for name in row["to"]]
called = [directory.at(key, row["ts"]) or name for key, name in zip(targets, row["to"], strict=True)]
spoken = {"speech": phrase(row["class"], directory.at(source, row["ts"]) or row["from"], called, row["text"]), "voice": self.speech.voice_of(source)}
radio.append({**row, "source": source, "targets": targets, "now": directory.now(source), **spoken})
grant_rows = [{**grant, "target": directory.key(grant["to"], grant["ts"])} for grant in grants(history, (begin, end), claims, tasks)]
self.watch.see(tasks, now)
jobs = [{**{key: value for key, value in job.items() if key != "proof"}, "output": job["output"][-OUTPUT_LIMIT:]} for job in self.jobs.listed()[-JOBS_SHOWN:]]
drawn = graph(radio, grant_rows, tasks, claims, end, directory)
first = self.first(news, history, claims, now)
drawn["track"] = track(drawn["nodes"], radio, tasks, claims, (min(max(begin, first), end), end), directory, steps)
people = {node["id"]: {"name": node["label"], "now": directory.now(node["id"]) or node["label"], "names": node["names"]} for node in drawn["nodes"] if node["kind"] != "subagent"}
settings = self.settings.get()
inbox = self.inbox(now, tasks, directory)
return {
"settings": settings,
"media": media_origins(settings),
"speech": self.speech.describe(),
"people": people,
"inbox": inbox,
"badges": badges(inbox, claims, self.jobs.listed(), now),
"pending": self.batches.listed(),
"rules": [{**{key: value for key, value in rule.items() if key != "proof"}, "signed": rule.get("proof") is not None} for rule in self.rules.listed()],
"approvers": self.keys(),
"jobs": jobs,
"views": VIEWS,
"kinds": dict(KINDS),
"llm": self.model.enabled(),
"now": now,
"since": begin,
"until": end,
"first": first,
"alarm_since": end - MAYDAY_ACTIVE,
"reviews": [row for row in map(review_row, self.reviews.pending()) if row["created_ts"] <= end],
"asks": [ask_row(ask, names) for ask in self.asks.pending() if ask["expires"] > now and ask["created_ts"] <= end],
"decisions": [decision_row(decision) for decision in self.decisions.pending() if decision["created_ts"] <= end],
"messages": [message_row(message) for message in self.messages.listed() if begin <= message["created_ts"] <= end],
"operator": operator_rows(tasks),
"register": register_rows(tasks),
"tasks": task_rows(tasks, queue_entries(self.council), self.tree.get()),
"agent_order": agent_order(tasks, claims, stored_order(self.council / AGENT_ORDER)),
"radio": radio,
"claims": claims,
"grants": grant_rows,
"night": night_mode(self.council),
"silence": silence_of(self.council, now),
"graph": drawn,
}
def stream_change(self, settings: dict, saved: dict) -> dict | None:
"""Args:
settings: valid settings the page wants to save.
saved: the settings saved now.
Returns:
The item the operator's passkey signs when the settings name a
stream url the saved ones do not, else None: the station origins
and those urls. The hub dials no url before it is signed, and
resolves its redirect targets only after the signature.
"""
urls = sorted({stream["url"] for stream in settings["streams"]} - {stream["url"] for stream in saved["streams"]})
return signing.stream_item(station_origins(settings), urls) if urls else None
def resolved(self, settings: dict, saved: dict) -> tuple[dict, list[str]]:
"""Args:
settings: valid settings whose new stream urls the operator
signed in this request.
saved: the settings saved now.
Returns:
The settings with the via of each new url taken from its redirect
chain, and of each saved url whose via is still None (unresolved)
once Redirects.due allows a retry; every other stream keeps its
saved via without a dial, and the page's via is never used. Also
one line per stream whose chain did not resolve; its via stays
None.
"""
known = {stream["url"]: stream["via"] for stream in saved["streams"]}
urls = {stream["url"] for stream in settings["streams"]}
outcomes = self.redirects.resolve(sorted(url for url in urls if url not in known or (known[url] is None and self.redirects.due(url))))
streams, problems = [], []
for stream in settings["streams"]:
via, problem = outcomes.get(stream["url"], (known.get(stream["url"]), ""))
if problem:
problems.append(f"{stream['name']}: {problem}")
streams.append({**stream, "via": via})
return {**settings, "streams": streams}, problems
def sign_settings(self, body: bytes) -> dict:
change = self.stream_change(valid_settings(decode(body)), self.settings.get())
return self.challenge_for([] if change is None else [change])
def save_settings(self, body: bytes) -> dict:
"""Returns:
{"settings", "problems"}: the saved settings, their via resolved
once the proof holds, and why a chain did not resolve. A save
that lands while this one resolves makes this one fail.
"""
payload = decode(body)
proof = payload.pop("proof", None)
settings = valid_settings(payload)
saved = self.settings.get()
change = self.stream_change(settings, saved)
if change is not None:
self.operator_proven(proof, change)
resolved, problems = self.resolved(settings, saved)
return {"settings": self.settings.put(resolved, saved), "problems": problems}
def render(self, nonce: str) -> tuple[str, str]:
now = time.time()
state = self.state(now - RADIO_WINDOW, now, now, 0)
page = self.templates.get_template("index.html.j2").render(nonce=nonce, state=state, icons=self.icons)
return page, INDEX_CSP.format(nonce, " ".join(["'self'", *state["media"]]))