@babtab/relay 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +35 -0
- package/LICENSE +1 -12
- package/README.es.md +27 -18
- package/README.hi.md +27 -18
- package/README.ja.md +25 -19
- package/README.ko.md +26 -18
- package/README.md +30 -19
- package/README.pt-BR.md +27 -18
- package/README.zh-TW.md +28 -19
- package/SECURITY.md +13 -12
- package/dist/relay.cjs +338 -6
- package/package.json +6 -3
package/SECURITY.md
CHANGED
|
@@ -10,28 +10,29 @@ Local-first relay. No hosted service, no telemetry, no account.
|
|
|
10
10
|
|
|
11
11
|
Older versions: upgrade via `npx @babtab/relay@latest`.
|
|
12
12
|
|
|
13
|
-
## What the relay sees
|
|
13
|
+
## What the relay sees
|
|
14
14
|
|
|
15
|
-
The relay
|
|
16
|
-
|
|
15
|
+
The relay forwards request parameters and results in memory, including entered
|
|
16
|
+
values, page observations and screenshots. It does not persist page content or
|
|
17
|
+
log request/response bodies. It must be trusted by the extension and the agent.
|
|
17
18
|
|
|
18
|
-
|
|
19
|
+
The token store (`BABTAB_TOKEN_FILE`, default `./data/relay-tokens.json`) contains
|
|
20
|
+
bearer tokens, client names, device IDs, scopes and expiry. Device credentials
|
|
21
|
+
stay in extension local storage and are verified from the first WebSocket frame;
|
|
22
|
+
the relay does not persist them. Use TLS for every non-loopback deployment.
|
|
19
23
|
|
|
20
|
-
|
|
21
|
-
- browser credentials, cookies, or API keys belonging to other tools,
|
|
22
|
-
- fill/select input values (the extension redacts them before display,
|
|
23
|
-
and the relay never persists request bodies).
|
|
24
|
+
## Device authentication upgrade
|
|
24
25
|
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
26
|
+
Update both relay and extension, then re-pair agents using the new `dev_v2_`
|
|
27
|
+
device ID. Knowledge of the public ID alone no longer permits registration or
|
|
28
|
+
pairing approval. Old unauthenticated device connections are rejected.
|
|
28
29
|
|
|
29
30
|
## Running it safely
|
|
30
31
|
|
|
31
32
|
- Bind is localhost by default (`http://127.0.0.1:3000`). Do not expose
|
|
32
33
|
it to a LAN / public IP unless you understand that anyone who can
|
|
33
34
|
reach the port can attempt pairing.
|
|
34
|
-
- Pairing codes are 6-digit
|
|
35
|
+
- Pairing codes are 6-digit and expire quickly. Approve
|
|
35
36
|
only codes you just requested; reject anything you don't recognize.
|
|
36
37
|
- HIGH-risk browser actions (submit, pay, delete, publish, password
|
|
37
38
|
fill) always require explicit approval in the extension Side Panel —
|