@1presence/bridge 0.9.0 → 0.10.0

package/dist/auth.js

@@ -11,11 +11,19 @@ const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
 // ─── Paths ────────────────────────────────────────────────────────────────────
 const CONFIG_DIR = (0, path_1.join)((0, os_1.homedir)(), '.1presence');
 const AUTH_FILE = (0, path_1.join)(CONFIG_DIR, 'auth.json');
 function ensureConfigDir() {
-    (0, fs_1.mkdirSync)(CONFIG_DIR, { recursive: true });
+    // 0o700: refresh token + session map live here; deny traversal to other local accounts.
+    (0, fs_1.mkdirSync)(CONFIG_DIR, { recursive: true, mode: 0o700 });
+}
+// writeFileSync's `mode` only applies when the file is newly created. chmodSync
+// covers the overwrite case so a legacy 0644 auth.json gets tightened on next save.
+function writeRestricted(path, data) {
+    (0, fs_1.writeFileSync)(path, data, { mode: 0o600 });
+    (0, fs_1.chmodSync)(path, 0o600);
 }
 // ─── JWT helpers ──────────────────────────────────────────────────────────────
 function parseJwt(token) {
@@ -57,7 +65,7 @@ function loadCachedAuth() {
 function saveCachedAuth(auth) {
     ensureConfigDir();
     const data = { ...auth, savedAt: Date.now() };
-    (0, fs_1.writeFileSync)(AUTH_FILE, JSON.stringify(data, null, 2), 'utf-8');
+    writeRestricted(AUTH_FILE, JSON.stringify(data, null, 2));
 }
 // ─── Browser auth flow ────────────────────────────────────────────────────────
 function openBrowser(url) {
@@ -77,9 +85,35 @@ exports.AuthCancelledError = AuthCancelledError;
 function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
     return new Promise((resolve, reject) => {
         let resolved = false;
+        // Per-launch nonce. Embedded in the auth URL the bridge prints/opens and
+        // required on every request to this localhost server. Without it, a
+        // malicious page in the user's browser could scan ephemeral ports during
+        // the auth window and POST a forged token to hijack the bridge.
+        const nonce = (0, crypto_1.randomBytes)(32).toString('base64url');
+        const nonceBuf = Buffer.from(nonce, 'utf-8');
+        function checkNonce(provided) {
+            if (!provided)
+                return false;
+            const provBuf = Buffer.from(provided, 'utf-8');
+            if (provBuf.length !== nonceBuf.length)
+                return false;
+            return (0, crypto_1.timingSafeEqual)(provBuf, nonceBuf);
+        }
+        // CORS allowlist scoped to the legitimate PWA origin only.
+        const pwaOrigin = (() => {
+            try {
+                return new URL(pwaUrl).origin;
+            }
+            catch {
+                return null;
+            }
+        })();
         const server = (0, http_1.createServer)((req, res) => {
-            // CORS headers so the PWA (https) can POST to http://localhost
-            res.setHeader('Access-Control-Allow-Origin', '*');
+            const reqOrigin = req.headers['origin'] ?? '';
+            if (pwaOrigin && reqOrigin === pwaOrigin) {
+                res.setHeader('Access-Control-Allow-Origin', pwaOrigin);
+            }
+            res.setHeader('Vary', 'Origin');
             res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
             res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
             if (req.method === 'OPTIONS') {
@@ -92,12 +126,18 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
                 res.end();
                 return;
             }
-            // Status beacon from the PWA — currently used so we exit early when
-            // the user closes the auth tab before signing in (sendBeacon path).
-            const path = (req.url ?? '/').split('?')[0];
+            const reqUrl = new URL(req.url ?? '/', 'http://localhost');
+            const path = reqUrl.pathname;
+            // Every POST must carry the launch-specific nonce.
+            if (!checkNonce(reqUrl.searchParams.get('nonce'))) {
+                res.writeHead(403);
+                res.end();
+                return;
+            }
+            // Status beacon from the PWA — used so we exit early when the user closes
+            // the auth tab before signing in (sendBeacon path).
             if (path === '/status') {
-                const params = new URL(req.url ?? '/', 'http://localhost').searchParams;
-                const event = params.get('event');
+                const event = reqUrl.searchParams.get('event');
                 res.writeHead(204);
                 res.end();
                 if (event === 'closed' && !resolved) {
@@ -138,7 +178,7 @@ function runBrowserAuthFlow(gatewayUrl, pwaUrl) {
         });
         server.listen(0, '127.0.0.1', () => {
             const { port } = server.address();
-            const authUrl = `${pwaUrl.replace(/\/$/, '')}/cli-auth?port=${port}`;
+            const authUrl = `${pwaUrl.replace(/\/$/, '')}/cli-auth?port=${port}&nonce=${encodeURIComponent(nonce)}`;
             console.log('\nOpening browser for sign-in…');
             console.log(`If the browser doesn't open, visit:\n  ${authUrl}\n`);
             openBrowser(authUrl);
@@ -196,7 +236,7 @@ function refreshAuth(auth) {
 }
 function clearAuth() {
     try {
-        (0, fs_1.writeFileSync)(AUTH_FILE, '{}', 'utf-8');
+        writeRestricted(AUTH_FILE, '{}');
     }
     catch { /* ignore */ }
 }

package/dist/index.js

@@ -72,7 +72,7 @@ async function writeSetupFiles(auth) {
         ?? (await fetchVaultFile('AGENT.md', token))
         ?? (await fetchVaultFile('CLAUDE.md', token))
         ?? '';
-    (0, fs_1.writeFileSync)(tmpFile(`agent-${uid}.md`), systemPrompt, 'utf-8');
+    writeRestricted(tmpFile(`agent-${uid}.md`), systemPrompt);
     if (VERBOSE) {
         console.log('\n[bridge:verbose] ─── system prompt ───────────────────────');
         console.log(systemPrompt);
@@ -88,7 +88,14 @@ async function writeSetupFiles(auth) {
             },
         },
     };
-    (0, fs_1.writeFileSync)(tmpFile(`mcp-${uid}.json`), JSON.stringify(mcpConfig, null, 2), 'utf-8');
+    writeRestricted(tmpFile(`mcp-${uid}.json`), JSON.stringify(mcpConfig, null, 2));
+}
+// The MCP config embeds a Bearer JWT and the system prompt may contain vault
+// state. writeFileSync's mode only takes effect on file creation — chmodSync
+// covers the overwrite case so a legacy 0644 file gets tightened on next run.
+function writeRestricted(path, data) {
+    (0, fs_1.writeFileSync)(path, data, { mode: 0o600 });
+    (0, fs_1.chmodSync)(path, 0o600);
 }
 // ─── Handle a single incoming message (token refresh + spawn) ─────────────────
 async function handleMessage(conversationId, text, sessionId, auth, vaultFileOpen, clientCapabilities, syncedFolders) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1presence/bridge",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Run 1Presence on your Mac and use your Claude.ai Pro subscription from any device",
   "bin": {
     "1presence-bridge": "dist/index.js"