@arthovlabs/liber 0.5.6 → 0.6.0

package/README.md

@@ -373,6 +373,52 @@ Every decision and every run is appended to `.liber/terminal-audit.log`, and
 Docker Desktop must be running for the container backend; when it is not, LiBER
 falls back to Constrained Language Mode and says so instead of pretending.
 
+Each line records `decision` (`allow`, `run` or **`deny`**), the command, the exit
+code and duration, the sandbox in force, and **who asked** — `agentId`, `client`
+and `turnId`. A refusal is the event an operator most needs to see, so it is
+logged with its reason instead of being swallowed. Files rotate at 5 MB
+(current → `.1`) so the trail stays readable.
+
+### Stopping a turn that is already running
+
+`POST /stop {"agentId":"dev-bot"}` is the kill switch. It marks the agent so the
+engine stops **before its next model call**, and it kills any command already
+running for it — on Windows the whole process tree, not just the shell wrapper.
+The turn ends with `stopped: true` and an honest "Stopped by you after N
+iterations. Nothing is claimed as complete." The desktop shell's ■ button calls
+this endpoint as well as aborting its own stream, so a turn started by a script is
+just as stoppable as one started by hand.
+
+## 🔗 Sharing a session (read-only links)
+
+Right-click a session in the sidebar → **Share link**. LiBER mints a 128-bit
+capability URL:
+
+```
+POST   /sessions/share            {"key":"dev-bot#<session>","ttl_hours":168}
+GET    /shared/<id>              no bearer token; the id is the credential
+GET    /sessions/share           list links, expiry and view count
+DELETE /sessions/share?id=<id>   revoke immediately
+```
+
+What a link can and cannot do:
+
+- **read only** — there is no route from a share id to `/chat`, `/config` or any
+  tool, so a leaked link cannot cost you tokens or change anything;
+- **sanitized** — the payload is built server-side: tool observations
+  (`OBSERVATION [E…]`), denials and internal retry prompts are dropped,
+  credentials are redacted, the account path becomes `~`, and long messages are
+  truncated. Rendering-side hiding is not relied on;
+- **expiring** — seven days by default, checked at read time, and revoked links
+  answer 404 rather than a cached copy.
+
+### Kill switch vs. share link
+
+A share link is deliberately *not* a token: it cannot be replayed into the API.
+The only thing it unlocks is `GET /shared/<id>`, once per request, while
+`expires_at` is in the future and `revoked` is false.
+
+
 ---
 
 ## 🔑 Clients and tokens

package/liber.yaml

@@ -70,7 +70,7 @@ policy:
     backend: "docker"
     image: "alpine:latest"
     allow_network: false
-    mode: "allowlist" # read_only: block state-changing commands · allowlist: only the list · prompt: HITL only
+    mode: "prompt" # ask the human for state-changing commands; read-only runs freely
     allowlist: ["npm test", "node --test", "git status", "git diff", "git add", "git commit", "git push"]
     denylist: []
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arthovlabs/liber",
-  "version": "0.5.6",
+  "version": "0.6.0",
   "description": "LiBER — autonomous agent orchestrator with a machine-enforced grounding gate and a skill library",
   "bin": {
     "liber": "bin/liber",

package/src/daemon/core/auth.js

@@ -21,7 +21,7 @@ const DEFAULT_LIMIT = 240; // requests per minute per client
 function scopeFor(method, endpoint) {
   if (endpoint === '/shutdown' || endpoint.startsWith('/clients')) return 'admin';
   if (endpoint.startsWith('/config') || endpoint === '/vault/migrate') return method === 'GET' ? 'read' : 'admin';
-  if (endpoint === '/chat' || endpoint === '/chat/stream' || endpoint === '/model/switch' || endpoint.endsWith('/run')) return 'chat';
+  if (endpoint === '/chat' || endpoint === '/chat/stream' || endpoint === '/model/switch' || endpoint === '/stop' || endpoint === '/sessions/share' || endpoint.endsWith('/run')) return 'chat';
   if (endpoint.startsWith('/hitl') || endpoint.startsWith('/memory') || endpoint.startsWith('/budget') || endpoint.startsWith('/sessions')) return 'chat';
   if (method === 'GET' || method === 'HEAD') return 'read';
   return 'tools';
@@ -123,6 +123,13 @@ function can(client, scope) {
   return list.includes('*') || list.includes(scope);
 }
 
+function rotateAudit(file, maxBytes = 5 * 1024 * 1024) {
+  try {
+    if (require('fs').statSync(file).size < maxBytes) return;
+    require('fs').renameSync(file, file + '.1');
+  } catch { /* first write, or a rotation race */ }
+}
+
 function audit(entry) {
   try {
     fs.mkdirSync(DIR(), { recursive: true });

package/src/daemon/core/engine.js

@@ -10,6 +10,7 @@ const budget = require('./budget');
 const verifier = require('./verifier');
 const journal = require('./journal');
 const injection = require('./injection');
+const stops = require('./stops');
 
 const DEFAULT_GROUNDING = {
   enabled: true,
@@ -398,14 +399,19 @@ class LiberEngine {
     depth = 0,
     allowedTools = null,
     resumeState = null,
-    shouldStop = null
+    shouldStop = null,
+    client = null
   }) {
     const resumed = !!resumeState;
     // The client can hang up mid-turn (stop button / closed window). Checked
     // between iterations so we stop spending tokens as soon as it does.
     const stopRequested = () => {
-      try { return typeof shouldStop === 'function' && shouldStop() === true; } catch { return false; }
+      try { if (typeof shouldStop === 'function' && shouldStop() === true) return true; } catch { /* socket may be gone */ }
+      // A /stop request is honoured even when no socket is watching: that is the
+      // whole point of a kill switch.
+      return stops.isRequested(agentId);
     };
+    stops.clear(agentId);
     let stopped = false;
     // Session history lives under its own key so a new session starts empty;
     // tracing, evidence and the breaker stay keyed to the real agent.
@@ -861,7 +867,7 @@ class LiberEngine {
             seq: ++subSeq
           });
         } else {
-          result = await registry.execute(call.name, call.args);
+          result = await registry.execute(call.name, call.args, { agentId, client: client || null, turnId: ledger.turnId || null });
         }
 
         // A tool can refuse for policy reasons and report that a human may
@@ -875,7 +881,7 @@ class LiberEngine {
           const approved = await waitForHitl(agentId, call.name, call.args);
           if (approved) {
             onEvent('hitl_approved', { tool: call.name, retried: true });
-            result = await registry.execute(call.name, call.args, { approved: true });
+            result = await registry.execute(call.name, call.args, { approved: true, agentId, client: client || null, turnId: ledger.turnId || null });
           } else {
             result = { error: `DENIED: approval was not granted. Tool '${call.name}' did not execute.`, policy_denied: true };
           }

package/src/daemon/core/http-guard.js

@@ -0,0 +1,47 @@
+// src/daemon/core/http-guard.js — two decisions every request makes before routing.
+//
+// Kept pure and small so both can be tested without a socket: which browser origin
+// is allowed to read a response, and how many requests an unauthenticated address
+// may make. Neither is a substitute for the bearer token; they shrink what a page
+// the user happens to visit, or a local probe, can do before it gets that far.
+
+const LOOPBACK = /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/;
+
+/** Returns the origin to reflect, or null when it must not be echoed back. */
+function allowOrigin(origin) {
+  const value = String(origin || '');
+  return LOOPBACK.test(value) ? value : null;
+}
+
+/**
+ * A per-address ceiling for routes that answer without a token.
+ * 240/min is far above what a shell does and far below what a probe wants.
+ */
+function createThrottle({ limit, windowMs = 60000 } = {}) {
+  const max = Number.isFinite(limit) ? limit : (Number(process.env.LIBER_UNAUTH_RPM) || 240);
+  const buckets = new Map();
+
+  return {
+    limit: max,
+    windowMs,
+    check(ip, now = Date.now()) {
+      const key = String(ip || 'local');
+      let bucket = buckets.get(key);
+      if (!bucket || now >= bucket.reset) {
+        bucket = { count: 0, reset: now + windowMs };
+        buckets.set(key, bucket);
+      }
+      bucket.count += 1;
+      const allowed = bucket.count <= max;
+      return {
+        allowed,
+        remaining: Math.max(0, max - bucket.count),
+        retryAfterMs: allowed ? 0 : Math.max(0, bucket.reset - now)
+      };
+    },
+    reset() { buckets.clear(); },
+    get size() { return buckets.size; }
+  };
+}
+
+module.exports = { allowOrigin, createThrottle, LOOPBACK };

package/src/daemon/core/providers.js

@@ -294,6 +294,42 @@ function status() {
   return { providers: rows, custom: customs };
 }
 
+/**
+ * Fill provider/endpoint when liber.yaml leaves them null.
+ *
+ * A fresh install ships `provider: null` and `endpoint: null` on purpose: the
+ * only thing the user is expected to hand over is a key. Nothing used to turn
+ * that key back into a base URL, so the adapter built `null/chat/completions`
+ * and every turn died — either as a URL parse error or, when a placeholder key
+ * from .env.example was sent instead, as HTTP 401. The endpoint has to come from
+ * whichever provider is actually configured.
+ */
+function engineDefaults(engine = {}) {
+  const cfg = { ...engine };
+  const missingProvider = !cfg.provider || cfg.provider === 'null';
+  const missingEndpoint = !cfg.endpoint || cfg.endpoint === 'null';
+  if (!missingProvider && !missingEndpoint) return cfg;
+
+  const { providers, custom } = status();
+  // Rank what is configured: an explicit custom endpoint first, then real API
+  // keys, and only then a local server. A machine that happens to run Ollama
+  // exports OLLAMA_HOST, which would otherwise hijack the endpoint away from a
+  // perfectly good cloud key.
+  const rank = p => (p.kind === 'custom' ? 0 : p.kind === 'api' ? 1 : 2);
+  const pick = [...custom, ...providers]
+    .filter(p => p.configured && p.base && p.adapter)
+    .sort((a, b) => rank(a) - rank(b))[0];
+  if (!pick) return cfg;
+
+  if (missingProvider) cfg.provider = pick.adapter;
+  if (missingEndpoint) cfg.endpoint = String(pick.base).replace(/\/+$/, '');
+  if (!cfg.apiKey) {
+    const key = resolve(pick.id, pick.base);
+    if (key) cfg.apiKey = key;
+  }
+  return cfg;
+}
+
 function imports() {
   return IMPORTS.map(i => {
     let present = false, when = null;
@@ -499,5 +535,6 @@ module.exports = {
   status, imports, importFrom,
   setKey, setToken, clear, setCustom,
   resolve, resolveStored, test, deviceStart, devicePoll,
+  engineDefaults,
   storePath: () => STORE()
 };

package/src/daemon/core/shares.js

@@ -0,0 +1,151 @@
+// src/daemon/core/shares.js — read-only session links (capability URLs).
+//
+// A share is a 128-bit id that maps to one session key. Whoever holds the id can
+// read that session; nobody can write through it. The daemon binds to 127.0.0.1,
+// so the link is only reachable from this machine (or a tunnel the operator
+// chooses). Expiry and revoke are first-class, not an afterthought.
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const secrets = require('./secrets');
+
+const MAX_MESSAGES = 400;
+const MAX_CHARS_PER_MESSAGE = 8000;
+const DEFAULT_TTL_HOURS = 24 * 7;
+
+function dir() {
+  return path.resolve(process.cwd(), '.liber');
+}
+function file() {
+  return process.env.LIBER_SHARES_FILE || path.join(dir(), 'shares.json');
+}
+
+function read() {
+  try {
+    const raw = JSON.parse(fs.readFileSync(file(), 'utf8'));
+    return { version: 1, shares: raw && typeof raw.shares === 'object' ? raw.shares : {} };
+  } catch {
+    return { version: 1, shares: {} };
+  }
+}
+
+function write(state) {
+  const target = file();
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  const tmp = target + '.tmp';
+  fs.writeFileSync(tmp, JSON.stringify(state, null, 2), 'utf8');
+  try { fs.chmodSync(tmp, 0o600); } catch { /* Windows has no POSIX mode; its ACL applies */ }
+  fs.renameSync(tmp, target);
+}
+
+function newId() {
+  return crypto.randomBytes(16).toString('hex');   // 32 hex chars = 128 bits
+}
+
+function create({ key, title = null, ttlHours = DEFAULT_TTL_HOURS } = {}) {
+  const sessionKey = String(key || '').trim();
+  if (!sessionKey) throw new Error('A session key is required to share.');
+
+  const hours = Number(ttlHours);
+  const ttl = Number.isFinite(hours) && hours > 0 ? Math.min(hours, 24 * 365) : DEFAULT_TTL_HOURS;
+
+  const state = read();
+  const id = newId();
+  const now = Date.now();
+  const record = {
+    id,
+    key: sessionKey,
+    title: title ? String(title).slice(0, 120) : null,
+    created_at: new Date(now).toISOString(),
+    expires_at: new Date(now + ttl * 3600 * 1000).toISOString(),
+    revoked: false,
+    views: 0,
+    last_viewed_at: null
+  };
+  state.shares[id] = record;
+  write(state);
+  return record;
+}
+
+function list() {
+  const state = read();
+  return Object.values(state.shares)
+    .sort((a, b) => String(b.created_at).localeCompare(String(a.created_at)))
+    .map(r => ({ ...r, expired: isExpired(r) }));
+}
+
+function isExpired(record) {
+  return !record || record.revoked === true || Date.parse(record.expires_at) <= Date.now();
+}
+
+/** Resolve a link for reading. Returns null for unknown, revoked or expired ids. */
+function resolve(id) {
+  const state = read();
+  const record = state.shares[String(id || '')];
+  if (!record || isExpired(record)) return null;
+
+  record.views = (record.views || 0) + 1;
+  record.last_viewed_at = new Date().toISOString();
+  try { write(state); } catch { /* a read must not fail because the counter could not be saved */ }
+  return record;
+}
+
+function revoke(id) {
+  const state = read();
+  const key = String(id || '');
+  if (!state.shares[key]) return false;
+  state.shares[key].revoked = true;
+  state.shares[key].revoked_at = new Date().toISOString();
+  write(state);
+  return true;
+}
+
+// Turns the model's own scaffolding into noise the reader never asked for, and
+// keeps anything that could identify this machine out of a link.
+const INTERNAL = /^(OBSERVATION \[E|DENIED:|GROUNDING AUDIT|STOP —|You have at most|You returned an empty response|Your reply contained no \[FINAL|Your previous answer)/;
+const HOME_PATHS = [
+  [new RegExp(String(process.env.USERPROFILE || '').replace(/[\\^$.*+?()[\]{}|]/g, '\\$&'), 'gi'), '~'],
+  // C:\Users\<name>\... and the POSIX equivalent, so a shared link never carries
+  // the account name of the machine it came from.
+  [/[A-Z]:\\Users\\[^\\\s"']+/gi, '~'],
+  [/\/home\/[^/\s"']+/g, '~'],
+  [/\/Users\/[^/\s"']+/g, '~']
+];
+
+function sanitize(messages = []) {
+  const out = [];
+  for (const m of messages) {
+    const role = m && m.role ? String(m.role) : 'user';
+    let content = String((m && m.content) || '');
+    if (INTERNAL.test(content)) continue;                 // tool output, retries, audits
+    content = secrets.redact(content);                    // keys, tokens, cards
+    for (const [rx, to] of HOME_PATHS) if (rx.source) content = content.replace(rx, to);
+    if (content.length > MAX_CHARS_PER_MESSAGE) {
+      content = content.slice(0, MAX_CHARS_PER_MESSAGE) + '\n… [truncated in the shared copy]';
+    }
+    out.push({ role, content, ts: (m && m.ts) || null });
+    if (out.length >= MAX_MESSAGES) break;
+  }
+  return out;
+}
+
+/** The only thing a public link ever returns. */
+function publicPayload(record, messages) {
+  return {
+    success: true,
+    share: {
+      id: record.id,
+      title: record.title,
+      created_at: record.created_at,
+      expires_at: record.expires_at,
+      read_only: true
+    },
+    messages: sanitize(messages)
+  };
+}
+
+module.exports = {
+  create, list, resolve, revoke, sanitize, publicPayload,
+  isExpired,
+  storePath: () => file()
+};

package/src/daemon/core/stops.js

@@ -0,0 +1,76 @@
+// src/daemon/core/stops.js — per-turn stop requests and the processes they own.
+//
+// The old kill switch was "close the browser": the SSE handler noticed the client
+// disconnecting and the engine stopped at the next iteration. That leaves two
+// holes: a caller with no socket (a script) cannot stop anything, and a terminal
+// command keeps running to completion. This module closes both: a request marks
+// the agent, and every child process started on its behalf is killed at once.
+const stops = new Map(); // agentId -> { requested: boolean, at: number|null, children: Set }
+
+function entry(agentId) {
+  const id = String(agentId || 'default');
+  if (!stops.has(id)) stops.set(id, { requested: false, at: null, children: new Set() });
+  return stops.get(id);
+}
+
+function request(agentId) {
+  const e = entry(agentId);
+  e.requested = true;
+  e.at = Date.now();
+  const killed = killChildren(agentId);
+  return { agentId: String(agentId || 'default'), killed };
+}
+
+function isRequested(agentId) {
+  const e = stops.get(String(agentId || 'default'));
+  return !!(e && e.requested);
+}
+
+function clear(agentId) {
+  const e = stops.get(String(agentId || 'default'));
+  if (e) { e.requested = false; e.at = null; }
+}
+
+/** Register a child process so /stop can end it mid-run. Returns a disposer. */
+function track(agentId, child) {
+  if (!child || typeof child.kill !== 'function') return () => {};
+  const e = entry(agentId);
+  e.children.add(child);
+  const done = () => e.children.delete(child);
+  child.once('exit', done);
+  child.once('error', done);
+  return done;
+}
+
+function killChildren(agentId) {
+  const e = entry(agentId);
+  let killed = 0;
+  for (const child of [...e.children]) {
+    try {
+      // Kill the direct child first — it is the one we have a handle on — then, on
+      // Windows, take the whole tree: powershell.exe dying does not stop the
+      // command it launched.
+      try { child.kill('SIGKILL'); } catch { /* already gone */ }
+      if (process.platform === 'win32' && child.pid) {
+        require('child_process').execFile('taskkill', ['/PID', String(child.pid), '/T', '/F'],
+          { windowsHide: true }, () => {});
+      }
+      killed += 1;
+    } catch { /* already gone */ }
+    e.children.delete(child);
+  }
+  return killed;
+}
+
+/** Called by the engine before it spends another model call or runs a tool. */
+function shouldStop(agentId) {
+  return isRequested(agentId);
+}
+
+function snapshot() {
+  return [...stops.entries()].map(([agentId, e]) => ({
+    agentId, requested: e.requested, at: e.at, children: e.children.size
+  }));
+}
+
+module.exports = { request, isRequested, clear, track, killChildren, shouldStop, snapshot };

package/src/daemon/core/tools/terminal-tool.js

@@ -248,12 +248,30 @@ function sandboxEnv() {
   return env;
 }
 
+const stops = require('../stops');
+
+function auditFile(name) {
+  return path.join(path.resolve(process.cwd(), '.liber'), name);
+}
+
+/**
+ * Keep an audit trail readable over months: when the file passes 5 MB it is
+ * rotated once (current -> .1, older .1 discarded). An audit log that grows
+ * without bound is the same as no audit log — nobody reads 200 MB.
+ */
+function rotate(file, maxBytes = 5 * 1024 * 1024) {
+  try {
+    if (fs.statSync(file).size < maxBytes) return;
+    fs.renameSync(file, file + '.1');
+  } catch { /* no file yet, or a rotation race — the append below still works */ }
+}
+
 function auditTerminal(entry) {
   try {
-    const dir = path.resolve(process.cwd(), '.liber');
-    fs.mkdirSync(dir, { recursive: true });
-    fs.appendFileSync(path.join(dir, 'terminal-audit.log'),
-      new Date().toISOString() + ' ' + JSON.stringify(entry) + '\n', 'utf8');
+    fs.mkdirSync(path.resolve(process.cwd(), '.liber'), { recursive: true });
+    const file = auditFile('terminal-audit.log');
+    rotate(file);
+    fs.appendFileSync(file, new Date().toISOString() + ' ' + JSON.stringify(entry) + '\n', 'utf8');
   } catch { /* auditing must never block a command */ }
 }
 
@@ -323,7 +341,7 @@ function containerUsable(force = false, image = 'alpine:latest') {
   return _runCache;
 }
 
-function runContainer(command, { cwd, timeout, profile }) {
+function runContainer(command, { cwd, timeout, profile, meta = {} }) {
   const { execFile } = require('child_process');
   const mount = `${path.resolve(process.cwd())}:/work:rw`;
   // On POSIX hosts run as the invoking user: files the container writes land
@@ -348,8 +366,9 @@ function runContainer(command, { cwd, timeout, profile }) {
     'sh', '-lc', command
   ];
   return new Promise((resolve) => {
-    execFile('docker', args, { timeout, maxBuffer: 10 * 1024 * 1024, windowsHide: true },
+    const child = execFile('docker', args, { timeout, maxBuffer: 10 * 1024 * 1024, windowsHide: true },
       (error, stdout, stderr) => resolve({ error, stdout: String(stdout || ''), stderr: String(stderr || '') }));
+    stops.track(meta.agentId, child);
   });
 }
 
@@ -357,7 +376,7 @@ function runContainer(command, { cwd, timeout, profile }) {
  * Run under Constrained Language Mode via a throwaway script file. A file avoids
  * every quoting trap that inline -Command has with quotes and $ signs.
  */
-function runSandboxed(command, { cwd, timeout }) {
+function runSandboxed(command, { cwd, timeout, meta = {} }) {
   const { execFile } = require('child_process');
   const tmpDir = path.resolve(process.cwd(), '.liber', 'tmp');
   fs.mkdirSync(tmpDir, { recursive: true });
@@ -368,13 +387,14 @@ function runSandboxed(command, { cwd, timeout }) {
     command + '\n', 'utf8');
 
   return new Promise((resolve) => {
-    execFile('powershell.exe',
+    const child = execFile('powershell.exe',
       ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', script],
       { cwd, timeout, maxBuffer: 10 * 1024 * 1024, windowsHide: true, env: sandboxEnv() },
       (error, stdout, stderr) => {
         try { fs.unlinkSync(script); } catch { }
         resolve({ error, stdout: String(stdout || ''), stderr: String(stderr || '') });
       });
+    stops.track(meta.agentId, child);
   });
 }
 
@@ -383,8 +403,17 @@ async function runTerminal({ command, timeout = 45000, cwd = process.cwd() }, me
     return { error: "Missing or invalid command argument." };
   }
 
+  const ctx = { agentId: meta.agentId || null, client: meta.client || null, turnId: meta.turnId || null };
   const decision = evaluatePolicy(command, { approved: meta && meta.approved === true });
   if (decision.denied) {
+    // A refusal is the event an operator most needs to see; it used to leave no trace.
+    auditTerminal({
+      decision: 'deny',
+      command,
+      reason: decision.reason,
+      needs_approval: decision.needs_approval === true,
+      ...ctx
+    });
     // Keep the escalation signal: a consumer (registry/engine) needs to know the
     // difference between "policy says no" and "policy says ask a human".
     return {
@@ -402,7 +431,7 @@ async function runTerminal({ command, timeout = 45000, cwd = process.cwd() }, me
   const sandbox = sandboxPolicy();
   const container = containerPolicy();
   const backend = container.on ? 'docker' : (sandbox.on ? 'constrained-language' : 'none');
-  auditTerminal({ decision: 'allow', command, cwd, sandbox: backend });
+  auditTerminal({ decision: 'allow', command, cwd, sandbox: backend, ...ctx });
 
   const finish = (error, stdout, stderr) => {
     const durationMs = Date.now() - startTime;
@@ -416,7 +445,7 @@ async function runTerminal({ command, timeout = 45000, cwd = process.cwd() }, me
       truncated = true;
     }
     const exitCode = error ? (typeof error.code === 'number' ? error.code : 1) : 0;
-    auditTerminal({ decision: 'run', command, exit_code: exitCode, duration_ms: durationMs, sandbox: backend });
+    auditTerminal({ decision: 'run', command, exit_code: exitCode, duration_ms: durationMs, sandbox: backend, ...ctx });
     if (error) {
       return {
         command,
@@ -448,7 +477,8 @@ async function runTerminal({ command, timeout = 45000, cwd = process.cwd() }, me
     const { error, stdout, stderr } = await runContainer(command, {
       cwd,
       timeout: parseInt(timeout, 10) || 45000,
-      profile: container
+      profile: container,
+      meta
     });
     return finish(error, stdout, stderr);
   }
@@ -456,13 +486,14 @@ async function runTerminal({ command, timeout = 45000, cwd = process.cwd() }, me
   if (sandbox.on) {
     const { error, stdout, stderr } = await runSandboxed(command, {
       cwd,
-      timeout: parseInt(timeout, 10) || 45000
+      timeout: parseInt(timeout, 10) || 45000,
+      meta
     });
     return finish(error, stdout, stderr);
   }
 
   return new Promise((resolve) => {
-    exec(
+    const child = exec(
       command,
       {
         cwd,
@@ -473,6 +504,7 @@ async function runTerminal({ command, timeout = 45000, cwd = process.cwd() }, me
       },
       (error, stdout, stderr) => resolve(finish(error, stdout, stderr))
     );
+    stops.track(meta.agentId, child);
   });
 }
 

package/src/daemon/liberd.js

@@ -10,6 +10,13 @@ const registry = require('./core/registry');
 const circuitBreaker = require('./core/circuit-breaker');
 const trace = require('./core/trace');
 const auth = require('./core/auth');
+const shares = require('./core/shares');
+const stops = require('./core/stops');
+
+const guard = require('./core/http-guard');
+
+// ceiling for the routes that answer without a token
+const unauth = guard.createThrottle();
 const policy = require('./core/policy');
 const journal = require('./core/journal');
 const modelSwitch = require('./core/model-switch');
@@ -323,10 +330,16 @@ class LiberDaemon {
     const endpoint = url.pathname;
     res.setHeader('Content-Type', 'application/json');
 
-    // CORS for the desktop shell (Neutralino/WebView2 origin) and any local client.
-    // The daemon binds to loopback and every stateful endpoint still requires the
-    // bearer token, so a wildcard origin does not weaken access control.
-    res.setHeader('Access-Control-Allow-Origin', '*');
+    // CORS: reflect only loopback origins. The shell is served from
+    // http://127.0.0.1:<port> (or localhost), so that is the whole allowlist.
+    // A wildcard used to be harmless only because of the bearer token; removing
+    // it means a page the user happens to visit cannot even attempt the call.
+    const origin = String(req.headers.origin || '');
+    const allowed = guard.allowOrigin(req.headers.origin);
+    if (allowed) {
+      res.setHeader('Access-Control-Allow-Origin', allowed);
+      res.setHeader('Vary', 'Origin');
+    }
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
     res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
     if (req.method === 'OPTIONS') {
@@ -335,6 +348,19 @@ class LiberDaemon {
       return;
     }
 
+    // The unauthenticated routes need a ceiling of their own: without a token there
+    // is nothing else to throttle against. 240/min per address is far above what a
+    // shell does and far below what a probe wants.
+    if (endpoint === '/healthz' || endpoint === '/whoami' || endpoint.startsWith('/shared/')) {
+      const gate = unauth.check(req.socket.remoteAddress || 'local');
+      if (!gate.allowed) {
+        res.statusCode = 429;
+        res.setHeader('retry-after', Math.ceil(gate.retryAfterMs / 1000));
+        res.end(JSON.stringify({ success: false, error: 'Too many requests without a token.' }));
+        return;
+      }
+    }
+
     // Unauthenticated liveness probe only — it exposes no state.
     if (endpoint === '/healthz') {
       res.end(JSON.stringify({ ok: true }));
@@ -359,6 +385,25 @@ class LiberDaemon {
       return;
     }
 
+    // A share link is a capability URL: the 128-bit id is the credential, so this
+    // route answers without a bearer token — and only ever returns one session,
+    // sanitized, with no tool output and no path from this machine.
+    if (req.method === 'GET' && endpoint.startsWith('/shared/')) {
+      const id = endpoint.slice('/shared/'.length);
+      // A revoked link must stop working in the browser too, not only on the wire:
+      // without this a cached copy keeps answering after DELETE /sessions/share.
+      res.setHeader('Cache-Control', 'no-store');
+      const record = shares.resolve(id);
+      if (!record) {
+        res.statusCode = 404;
+        res.end(JSON.stringify({ success: false, error: 'This link is unknown, expired or revoked.' }));
+        return;
+      }
+      const messages = memory.get(record.key) || [];
+      res.end(JSON.stringify(shares.publicPayload(record, messages)));
+      return;
+    }
+
     // Every request is resolved to a client, then checked for scope and rate.
     const requestStart = Date.now();
     const client = auth.verify(auth.extract(req));
@@ -497,9 +542,57 @@ class LiberDaemon {
         let body = '';
         for await (const chunk of req) body += chunk;
         const { verdict } = JSON.parse(body || '{}');
-        const handled = this.resolveHitl(verdict === 'approve' || verdict === true);
+        const approved = verdict === 'approve' || verdict === true;
+        auth.audit({ client: client.id, endpoint, decision: approved ? 'approve' : 'deny', reason: 'hitl verdict' });
+        const handled = this.resolveHitl(approved);
         res.end(JSON.stringify({ success: true, handled }));
       }
+      else if (endpoint === '/stop') {
+        // The kill switch. It marks the agent so the engine stops before its next
+        // model call, and kills any command already running for it.
+        let body = '';
+        for await (const chunk of req) body += chunk;
+        const { agentId } = JSON.parse(body || '{}');
+        if (!agentId) {
+          res.statusCode = 400;
+          res.end(JSON.stringify({ success: false, error: 'Missing agentId.' }));
+          return;
+        }
+        const out = stops.request(agentId);
+        logger.warn(agentId, 'STOP_REQUESTED', { client: client.id, killed: out.killed });
+        auth.audit({ client: client.id, endpoint, decision: 'allow', reason: 'stop ' + agentId, killed: out.killed });
+        res.end(JSON.stringify({ success: true, agentId: out.agentId, killed: out.killed }));
+      }
+      else if (endpoint === '/sessions/share') {
+        if (req.method === 'GET') {
+          res.end(JSON.stringify({ success: true, shares: shares.list() }));
+          return;
+        }
+        if (req.method === 'DELETE') {
+          const id = url.searchParams.get('id');
+          const ok = shares.revoke(id);
+          auth.audit({ client: client.id, endpoint, decision: ok ? 'allow' : 'deny', reason: 'revoke ' + (id || '(none)') });
+          res.statusCode = ok ? 200 : 404;
+          res.end(JSON.stringify({ success: ok, revoked: ok ? id : null }));
+          return;
+        }
+        let body = '';
+        for await (const chunk of req) body += chunk;
+        const { key, title, ttl_hours } = JSON.parse(body || '{}');
+        if (!key) {
+          res.statusCode = 400;
+          res.end(JSON.stringify({ success: false, error: 'Missing session key.' }));
+          return;
+        }
+        if (!(memory.get(key) || []).length) {
+          res.statusCode = 404;
+          res.end(JSON.stringify({ success: false, error: 'No such session: ' + key }));
+          return;
+        }
+        const record = shares.create({ key, title, ttlHours: ttl_hours });
+        auth.audit({ client: client.id, endpoint, decision: 'allow', reason: 'share ' + record.id });
+        res.end(JSON.stringify({ success: true, share: record, path: '/shared/' + record.id }));
+      }
       else if (endpoint === '/sessions/history') {
         // The window keeps rendered HTML in memory only, so after a restart a
         // session looked empty while its messages were still on disk. This
@@ -1283,7 +1376,8 @@ class LiberDaemon {
             onEvent: sendEvent,
             waitForHitl: (aid, toolName, args) => this.waitForHitl(aid, `${toolName}: ${JSON.stringify(args)}`),
             maxLoops: this.maxLoops,
-            shouldStop
+            shouldStop,
+            client: client.id
           }));
           if (this.traceEnabled) {
             trace.appendTurn({ agentId, userMessage: message, result, model: agent.config.engine?.model });
@@ -1307,6 +1401,7 @@ class LiberDaemon {
           memoryKey,
           agentConfig: agent.config,
           userMessage: message,
+          client: client.id,
           memory,
           llmManager,
           // This endpoint answers with one JSON body, so there is no channel to

package/src/daemon/llm/manager.js

@@ -22,6 +22,11 @@ class LLMManager {
    * @param {Object} config - Bagian 'engine' dari liber.yaml
    */
   initialize(config) {
+    // liber.yaml may leave provider/endpoint null and expect the installed key
+    // to supply them; resolve before anything reads config.endpoint, or the
+    // adapter ends up requesting null/chat/completions.
+    const { engineDefaults } = require('../core/providers');
+    config = engineDefaults(config);
     this.engineConfig = { ...config };
     const ProviderClass = this.adapters[config.provider];
     if (!ProviderClass) {