@broberg/lens-daemon 0.1.26 → 0.1.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@broberg/lens-daemon",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "The Lens module of the cardmem daemon (flows, critic, coverage, capture sessions, the /lens/* routes and the cardmem-lens MCP) as a package. The daemon mounts createLensRouter(deps) + createLensMcpRouter(deps). Bun runtime.",
   "type": "module",
   "license": "MIT",
@@ -15,8 +15,8 @@
     "sharp": "^0.33.5",
     "turndown": "^7.2.4",
     "zod": "^3.23.8",
-    "@broberg/lens-svg": "0.1.0",
-    "@broberg/lens-engine": "0.13.1"
+    "@broberg/lens-engine": "0.14.0",
+    "@broberg/lens-svg": "0.1.0"
   },
   "devDependencies": {
     "@happy-dom/global-registrator": "^20.10.6",

package/src/frames.ts

@@ -49,6 +49,11 @@ export async function cutFrames(
   bin = 'ffmpeg',
 ): Promise<CutResult> {
   const fps = opts.fps ?? 4;
+  // fps is pasted into an ffmpeg filter string: a non-number there is a second
+  // filter (H4, 2026-10-21 — drawtext=textfile=… drew a file into a frame).
+  if (typeof fps !== 'number' || !Number.isFinite(fps) || fps <= 0 || fps > 120) {
+    throw new Error(`cutFrames: fps must be a number above 0 and at most 120 — got ${JSON.stringify(fps)}`);
+  }
   if (!(await ffmpegAvailable(bin))) {
     return { frames: [], unavailable: `${bin} is not installed — video kept, no stills` };
   }

package/src/http.ts

@@ -31,9 +31,12 @@ import {
 import { drainUploads, uploadStats } from './artifact-uploads.ts';
 import { backfillFromDisk } from './artifact-backfill.ts';
 import { artifactContentType } from './storage.ts';
+import { localRequestGuard } from './local-guard.ts';
 
 export function createLensRouter(deps: LensDeps): Hono {
   const r = new Hono();
+  // Security sweep 2026-10-21 (H1–H4): loopback Host + JSON writes only. First.
+  r.use('*', localRequestGuard(deps.port));
   // lens F001.5 — the daemon's sandbox is injected, never copied (sandbox.ts).
   if (deps.resolveSandboxedPath) setSandboxResolver(deps.resolveSandboxedPath);
   // lens F001.5 — the routes that used to be registered one by one in the

package/src/local-guard.ts

@@ -0,0 +1,41 @@
+// Security sweep 2026-10-21, high findings H1–H4: the daemon on 127.0.0.1 took
+// a call from anyone who could make a browser send one — a DNS-rebound page
+// (it never checked Host) or any site's "simple" text/plain POST (it parsed JSON
+// whatever the content type). Through that door a page could read any file
+// (/lens/artifact), drive the owner's logged-in profile, mint a secret to its
+// own URL, or approve a baseline.
+//
+// Two rules close it without a token, because a browser cannot break either:
+//   · Host must name this loopback daemon — a rebound page sends its own name.
+//   · A write (POST/PUT/PATCH/DELETE) must be application/json — a cross-site
+//     page cannot send that without a CORS preflight, and the preflight is only
+//     granted to the daemon shell's own allowlisted origins.
+// Lens' own Chromium visiting a hostile page is the same case as any browser.
+//
+// A non-browser caller (curl, an MCP client, the cardmem SPA via CORS) already
+// sends both, so nothing legitimate changes.
+
+import type { MiddlewareHandler } from 'hono';
+
+const WRITE = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+export function localRequestGuard(port: number): MiddlewareHandler {
+  const hosts = new Set([`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`]);
+  return async (c, next) => {
+    // A server request carries Host; Bun builds c.req.url from it, so the URL's
+    // host is the same value when the header is not on the Request object.
+    const host = (c.req.header('host') ?? new URL(c.req.url).host).toLowerCase();
+    if (!hosts.has(host)) {
+      return c.json({ ok: false, error: `lens daemon: refused Host "${host}" — only this machine's loopback address may call it` }, 421);
+    }
+    if (WRITE.has(c.req.method)) {
+      const type = (c.req.header('content-type') ?? '').split(';')[0]!.trim().toLowerCase();
+      // A body-less DELETE (the MCP session close) carries no content type.
+      const empty = c.req.method === 'DELETE' && !c.req.header('content-length') && !type;
+      if (type !== 'application/json' && !empty) {
+        return c.json({ ok: false, error: 'lens daemon: a write must be Content-Type: application/json' }, 415);
+      }
+    }
+    await next();
+  };
+}

package/src/mcp.ts

@@ -9,6 +9,7 @@
 
 import { Hono } from 'hono';
 import { MANUSCRIPT_VERBS, STEP_TYPES } from './flow.ts';
+import { localRequestGuard } from './local-guard.ts';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
 import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
@@ -546,6 +547,7 @@ async function dispatch(deps: LensDeps, name: string, args: any): Promise<unknow
 
 export function createLensMcpRouter(deps: LensDeps): Hono {
   const router = new Hono();
+  router.use('*', localRequestGuard(deps.port));
   router.all('/', async (c) => {
     const server = new Server(
       { name: 'cardmem-lens', version: '0.1.0' },

package/src/record-run.ts

@@ -85,6 +85,13 @@ export async function runRecord(raw: RecordRequest, deps: RecordDeps) {
     seed_tabs?: { session: string; channel?: string; label?: string }[];
   };
   if (!body.url) return { ok: false as const, status: 400, error: 'url required' };
+  // Both reach an ffmpeg filter string. 0 = no stills (burst), never a string.
+  for (const k of ['fps', 'burst_fps'] as const) {
+    const v = body[k];
+    if (v !== undefined && (typeof v !== 'number' || !Number.isFinite(v) || v < 0 || v > 120)) {
+      return { ok: false as const, status: 400, error: `${k} must be a number from 0 to 120` };
+    }
+  }
   const project = body.project ?? 'lens';
   try {
     let auth = body.auth as AuthConfig | undefined;
@@ -311,7 +318,8 @@ export async function runRecord(raw: RecordRequest, deps: RecordDeps) {
       const vid = nodePath.join(dir, 'run.webm');
       await writeFile(vid, result.video);
       const cuts: { t: number; file: string; near?: number }[] = [];
-      const sparse = await cutFrames(vid, nodePath.join(dir, 'sparse'), { fps: body.fps ?? 2 });
+      // fps 0 = no timeline stills (the documented off switch), not an ffmpeg call.
+      const sparse = body.fps === 0 ? { frames: [] } : await cutFrames(vid, nodePath.join(dir, 'sparse'), { fps: body.fps ?? 2 });
       if (sparse.unavailable) framesUnavailable = sparse.unavailable;
       cuts.push(...sparse.frames.map((f) => ({ t: f.t, file: f.file })));
       const burstFps = body.burst_fps ?? 12;

package/src/storage.ts

@@ -18,7 +18,7 @@
 
 import { S3Client } from 'bun';
 import { mkdir, readFile, writeFile, rm } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { dirname, isAbsolute, resolve, sep } from 'node:path';
 
 export interface LensStorage {
   readonly backend: 'local' | 'tigris';
@@ -31,8 +31,15 @@ class LocalDirStorage implements LensStorage {
   readonly backend = 'local' as const;
   constructor(private readonly root: string) {}
 
+  /** A key is a path INSIDE the store, never a way out of it (H2, 2026-10-21:
+   *  `../../.ssh/id_rsa` was served by /lens/artifact). */
   private path(key: string): string {
-    return join(this.root, key);
+    const root = resolve(this.root);
+    const p = resolve(root, key);
+    if (isAbsolute(key) || (p !== root && !p.startsWith(root + sep))) {
+      throw new Error(`lens storage: key escapes the artifact store: ${JSON.stringify(key)}`);
+    }
+    return p;
   }
 
   async put(key: string, bytes: Buffer): Promise<void> {