@decibelsystems/tools 2.1.2 → 2.1.4

package/dist/httpServer.js

@@ -25,16 +25,20 @@
  *   { "status": "error", "error": "...", "code": "..." }
  */
 import { createServer } from 'http';
-import { timingSafeEqual } from 'crypto';
+import { timingSafeEqual, randomBytes } from 'crypto';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import { log } from './config.js';
+import { writeLocalAgentSession } from './agentPresence.js';
+import { drainCommands, setSessionToken, getSessionToken, dropSessionToken, ackOwnerOf, clearAckOwner, } from './agentInbox.js';
+import { settleCommandFromAck, ORG_ID } from './agentCommands.js';
 import { isSupabaseConfigured, getSupabaseServiceClient } from './lib/supabase.js';
 import { shouldQueueForAgent, parseToolCall } from './httpQueueDetection.js';
 import { getLicenseValidator } from './license.js';
 import { listProjects } from './projectRegistry.js';
+import { setDaemonPort } from './daemon.js';
 import { listEpics, listRepoIssues, isProjectResolutionError, } from './tools/sentinel.js';
 import { voiceInboxAdd, } from './tools/voice.js';
 import { generateImage, getImageStatus, meshyGenerate, getMeshyStatus, meshyDownload, tripoGenerate, getTripoStatus, tripoDownload, klingGenerateVideo, klingGenerateTextVideo, klingGenerateAvatar, getKlingStatus, listTasks, } from './tools/studio/index.js';
@@ -45,6 +49,12 @@ let startedAt = 0;
 let sseConnectionCount = 0;
 let agentRegistry;
 let daemonConfig;
+// Mirrored from startHttpServer options so module-scoped executeTool can reason
+// about the connection's trust boundary (the 127.0.0.1 daemon bind vs a
+// network-exposed --http server) and whether auth is enforced. Used by the
+// queue-write authorization decoupling (principal, not label).
+let serverIsDaemon = false;
+let serverAuthToken;
 // ============================================================================
 // Security: Body Size Limit
 // ============================================================================
@@ -103,6 +113,46 @@ function timingSafeTokenCompare(provided, expected) {
     }
     return timingSafeEqual(a, b);
 }
+/**
+ * The connection's trust boundary for the /agents/* endpoints: ONLY a process on
+ * this machine may register/poll/ack a local runtime (the 127.0.0.1 bind is the
+ * principal — confused-deputy rule). We check the real socket peer address (not a
+ * spoofable header). An EMPTY remoteAddress is rejected (was previously allowed) —
+ * a genuine TCP loopback connection always presents 127.0.0.1/::1, so empty only
+ * arises from a destroyed/odd socket and must not be treated as local.
+ */
+function isLocalAgentPeer(req) {
+    const peer = (req.socket.remoteAddress || '').replace('::ffff:', '');
+    return peer === '127.0.0.1' || peer === '::1';
+}
+/**
+ * Mint-or-return the per-session capability token (proof-of-possession the SDK must
+ * present on poll/ack). Idempotent per session_key so a heartbeat keeps the token
+ * stable; after a daemon restart the in-memory store is empty, so the next
+ * register/heartbeat mints a fresh one and the SDK adopts it from the response.
+ */
+function ensureSessionToken(sessionKey) {
+    let token = getSessionToken(sessionKey);
+    if (!token) {
+        token = randomBytes(32).toString('hex');
+        setSessionToken(sessionKey, token);
+    }
+    return token;
+}
+/**
+ * True only for genuine localhost origins. Parses the Origin URL and compares the
+ * HOST exactly (localhost / 127.0.0.1 / [::1]) — NOT a startsWith prefix, which
+ * `https://localhost.evil.com` and `http://127.0.0.1.evil.com` both defeat.
+ */
+function isLocalhostOrigin(origin) {
+    try {
+        const { hostname } = new URL(origin);
+        return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '[::1]';
+    }
+    catch {
+        return false;
+    }
+}
 // ============================================================================
 // Version Info
 // ============================================================================
@@ -167,8 +217,33 @@ function wrapSuccess(data) {
 /**
  * Wrap an error in status envelope
  */
+/**
+ * Sanitize error messages to prevent information disclosure.
+ * Removes absolute file paths and replaces with generic placeholders.
+ * Preserves URLs and relative paths.
+ */
+function sanitizeErrorMessage(message) {
+    let sanitized = message;
+    // Step 1: Preserve paths containing .decibel (keep the .decibel part, strip prefix)
+    // /home/user/project/.decibel/foo -> .decibel/foo
+    sanitized = sanitized.replace(/(?:\/[^\s:'"]+)?\/\.decibel\//g, '.decibel/');
+    sanitized = sanitized.replace(/(?:[A-Z]:\\[^\s:'"]+)?\\\.decibel\\/gi, '.decibel\\');
+    // Step 2: Remove absolute Unix paths (must start with / and have at least one more /)
+    // But exclude URLs (http://, https://, file://)
+    // Match: /home/user/file.txt, /var/log/app.log
+    // Don't match: http://example.com, ./relative/path
+    sanitized = sanitized.replace(/(?<!:)\/(?:home|Users|var|tmp|opt|usr|etc|media|mnt)\/[^\s:'"]+/g, '[path]');
+    // Step 3: Remove Windows absolute paths (C:\, D:\, etc.)
+    sanitized = sanitized.replace(/[A-Z]:\\[^\s:'"]+/gi, '[path]');
+    // Step 4: Sanitize any remaining usernames in paths that weren't caught
+    sanitized = sanitized.replace(/\/home\/[^\/\s]+\//g, '/home/[user]/');
+    sanitized = sanitized.replace(/\/Users\/[^\/\s]+\//g, '/Users/[user]/');
+    sanitized = sanitized.replace(/C:\\Users\\[^\\]+\\/gi, 'C:\\Users\\[user]\\');
+    return sanitized;
+}
 function wrapError(error, code) {
-    return { status: 'error', error, ...(code && { code }) };
+    const sanitized = sanitizeErrorMessage(error);
+    return { status: 'error', error: sanitized, ...(code && { code }) };
 }
 /**
  * Send JSON response with status envelope
@@ -215,8 +290,32 @@ async function executeTool(tool, args, req, tierOverride) {
     try {
         // Extract agent context from HTTP headers
         const headerAgentId = req?.headers['x-agent-id'];
-        // Queue detection: if this is a write call from a remote agent, queue instead of execute
-        if (headerAgentId && shouldQueueForAgent(tool, args, headerAgentId)) {
+        // Queue detection: if this is a write call from a remote agent, queue instead of execute.
+        //
+        // AUTHORIZATION DECOUPLING (sec review 2026-06-07, issue B / confused-deputy):
+        // queueForAgent writes to agent_queue via SERVICE_ROLE (bypassing RLS) with
+        // created_by = agentId. That is a PRIVILEGED side effect, so the agent identity
+        // MUST come from an authenticated PRINCIPAL of the connection — never a
+        // caller-supplied X-Agent-Id label (which anyone can set, and — via the
+        // unauthenticated /connect — even pre-register, so registry membership is NOT
+        // an authenticated identity). The trust boundary differs by mode:
+        //   - localhost daemon (serverIsDaemon): the 127.0.0.1 bind IS the principal
+        //     boundary — only local processes reach it. A local process naming an
+        //     agent_id is acceptable for a local-sync write. Keep the known-agent check
+        //     as defense-in-depth.
+        //   - hosted/--http (network-exposed): the principal is the bound auth token.
+        //     A queue write is allowed ONLY if the request authenticated (serverAuthToken
+        //     set AND this request passed it — it reached here past the auth gate). With
+        //     no auth token configured, there is NO authenticated principal, so refuse to
+        //     do a service-role write on a spoofable label; fall through to normal
+        //     dispatch (tier/facade checks) instead.
+        const agentIsKnown = !!headerAgentId &&
+            ((agentRegistry?.get(headerAgentId) !== undefined) ||
+                daemonConfig?.agents?.[headerAgentId] !== undefined);
+        const principalAuthorizesQueueWrite = serverIsDaemon
+            ? agentIsKnown // local bind = principal; known-agent is DiD
+            : !!serverAuthToken && agentIsKnown; // hosted: require an authenticated request
+        if (headerAgentId && principalAuthorizesQueueWrite && shouldQueueForAgent(tool, args, headerAgentId)) {
             const parsed = parseToolCall(tool, args);
             const { action: _action, ...queueArgs } = args;
             return await queueForAgent(parsed.facade, parsed.action, queueArgs, headerAgentId, args.projectId || 'default');
@@ -243,6 +342,7 @@ async function executeTool(tool, args, req, tierOverride) {
             scope: req.headers['x-scope'],
             engagementMode: req.headers['x-engagement-mode'],
             userKey: req.headers['x-user-key'],
+            orgId: req.headers['x-org-key'],
             requestId: req.headers['x-request-id'],
             tier: tierOverride,
             allowedFacades,
@@ -348,8 +448,13 @@ function getOpenAITools() {
  * - Config-level key → use that as default
  */
 async function resolveTier(req, configLicenseKey) {
-    // Dev mode bypass
-    if (process.env.DECIBEL_PRO === '1' || process.env.NODE_ENV !== 'production') {
+    // Dev mode bypass — EXPLICIT opt-in only. Previously this also fired on
+    // `NODE_ENV !== 'production'`, which fails OPEN: the default for
+    // `node dist/server.js --http`, most containers, and Render/Heroku is an unset
+    // NODE_ENV, so every unauthenticated hosted caller silently got 'pro'/'apps'.
+    // The request-time tier boundary must fail CLOSED to 'core' unless an operator
+    // explicitly opts in via DECIBEL_PRO=1. (Sec review 2026-06-04, ISS tier-gating.)
+    if (process.env.DECIBEL_PRO === '1') {
         return 'pro';
     }
     // Extract license key from Authorization header (separate from auth token)
@@ -379,6 +484,8 @@ export async function startHttpServer(server, kernelInstance, options) {
     startedAt = Date.now();
     agentRegistry = optAgentRegistry;
     daemonConfig = optDaemonConfig;
+    serverIsDaemon = isDaemon;
+    serverAuthToken = authToken;
     log(`HTTP: Using kernel with ${kernel.toolCount} tools`);
     // Rate limiter (clean up stale entries every 60s)
     const rateLimiter = new RateLimiter(rateLimitRpm);
@@ -441,15 +548,22 @@ export async function startHttpServer(server, kernelInstance, options) {
             res.setHeader('Access-Control-Allow-Origin', '*');
         }
         else {
-            // Daemon mode: restrict REST endpoints to localhost origins
+            // Daemon mode: restrict REST endpoints to localhost origins.
+            // EXACT host match — a prefix/startsWith check is bypassable by an attacker
+            // origin like `https://localhost.evil.com` or `http://127.0.0.1.evil.com`
+            // (both startWith an allowed value), which would let a malicious page read
+            // localhost daemon data cross-origin. Parse the origin and compare host.
             const origin = req.headers.origin || '';
-            const localhostOrigins = ['http://localhost', 'http://127.0.0.1', 'https://localhost', 'https://127.0.0.1'];
-            if (localhostOrigins.some(lo => origin.startsWith(lo)) || !origin) {
-                res.setHeader('Access-Control-Allow-Origin', origin || 'http://localhost');
+            if (!origin) {
+                // Non-CORS (curl, same-origin) — no ACAO needed.
+            }
+            else if (isLocalhostOrigin(origin)) {
+                res.setHeader('Access-Control-Allow-Origin', origin);
             }
+            // else: untrusted origin → no ACAO header (browser blocks the read).
         }
         res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Mcp-Session-Id, Accept, X-Agent-Id, X-Run-Id, X-License-Key, X-Allowed-Facades, X-Scope, X-Request-Id, X-Parent-Call-Id, X-Engagement-Mode, X-User-Key');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Mcp-Session-Id, Accept, X-Agent-Id, X-Run-Id, X-License-Key, X-Allowed-Facades, X-Scope, X-Request-Id, X-Parent-Call-Id, X-Engagement-Mode, X-User-Key, X-Org-Key');
         res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id');
         // (a) Handle preflight OPTIONS requests
         if (req.method === 'OPTIONS') {
@@ -457,6 +571,21 @@ export async function startHttpServer(server, kernelInstance, options) {
             res.end();
             return;
         }
+        // HOSTED FAIL-CLOSED, checked EARLY (before the rate limiter) so an
+        // unauthenticated hosted caller can't consume/poison the rate-limit map or any
+        // downstream state before being refused. Public infra routes stay open so
+        // health/landing/discovery keep working; everything else needs auth in hosted
+        // (--http) mode. (Sec review 2026-06-07; the main gate below still enforces the
+        // token when one IS configured.)
+        const PUBLIC_HOSTED_ROUTES = new Set([
+            '/', '/health', '/ready', '/docs', '/tools', '/openapi.yaml', '/openapi.json',
+            '/.well-known/oauth-authorization-server', '/.well-known/openid-configuration',
+            '/oauth/authorize', '/oauth/token', '/oauth/register',
+        ]);
+        if (!isDaemon && !authToken && !PUBLIC_HOSTED_ROUTES.has(path)) {
+            sendJson(res, 401, wrapError('This endpoint requires authentication. Hosted (--http) mode must be started with DECIBEL_AUTH_TOKEN set.', 'AUTH_NOT_CONFIGURED'));
+            return;
+        }
         // Rate limiting (check before auth to prevent brute force)
         const clientIp = (req.socket.remoteAddress || '127.0.0.1').replace('::ffff:', '');
         const reqAgentId = req.headers['x-agent-id'];
@@ -487,8 +616,9 @@ export async function startHttpServer(server, kernelInstance, options) {
         // Health check at /health too
         if (path === '/health') {
             const uptimeMs = Date.now() - startedAt;
-            // Determine pro status from config license key
-            const proEnabled = process.env.DECIBEL_PRO === '1' || process.env.NODE_ENV !== 'production';
+            // Determine pro status from config license key. Explicit opt-in only —
+            // do NOT infer from NODE_ENV (fails open on hosted; see resolveTier).
+            const proEnabled = process.env.DECIBEL_PRO === '1';
             let licenseTier = proEnabled ? 'pro' : 'core';
             if (configLicenseKey && !proEnabled) {
                 const cached = getLicenseValidator().getCachedResult(configLicenseKey);
@@ -528,6 +658,22 @@ export async function startHttpServer(server, kernelInstance, options) {
         }
         // GET /events — query dispatch event log (dispatch.jsonl)
         if (path === '/events' && req.method === 'GET') {
+            // AUTH BEFORE DATA: /events returns operational telemetry (agent ids, tool
+            // names, run/request ids, timestamps, error strings). It sits above the main
+            // auth gate, so it must enforce auth itself (sec review 2026-06-04/06-07):
+            //   - hosted (--http) with no token → fail closed (no authenticated principal);
+            //   - any mode with a token → require it.
+            if (!isDaemon && !authToken) {
+                sendJson(res, 401, wrapError('This endpoint requires authentication. Hosted (--http) mode must be started with DECIBEL_AUTH_TOKEN set.', 'AUTH_NOT_CONFIGURED'));
+                return;
+            }
+            if (authToken) {
+                const authHeader = req.headers.authorization;
+                if (!authHeader || !timingSafeTokenCompare(authHeader, `Bearer ${authToken}`)) {
+                    sendJson(res, 401, wrapError('Unauthorized', 'UNAUTHORIZED'));
+                    return;
+                }
+            }
             const dispatchLogPath = join(process.env.HOME || '~', '.decibel', 'logs', 'dispatch.jsonl');
             try {
                 const content = readFileSync(dispatchLogPath, 'utf-8');
@@ -614,6 +760,18 @@ export async function startHttpServer(server, kernelInstance, options) {
             res.end(JSON.stringify({ error: 'Not found' }));
             return;
         }
+        // HOSTED FAIL-CLOSED (sec review 2026-06-07, issue A): in --http (non-daemon)
+        // mode the server is network-exposed. If no auth token is configured there is
+        // NO authenticated principal, so every route that reaches this gate (the
+        // sensitive surface — /call, /connect, /batch, /mcp, /events, etc.; the public
+        // infra routes /, /health, /docs, /tools-html, /openapi, OAuth already returned
+        // above) MUST be refused rather than served open. In localhost daemon mode the
+        // 127.0.0.1 bind is the boundary, so an unset token stays allowed there.
+        if (!isDaemon && !authToken) {
+            log('HTTP: refusing request — hosted mode requires DECIBEL_AUTH_TOKEN');
+            sendJson(res, 401, wrapError('This endpoint requires authentication. Hosted (--http) mode must be started with DECIBEL_AUTH_TOKEN set.', 'AUTH_NOT_CONFIGURED'));
+            return;
+        }
         // Auth check (timing-safe comparison to prevent timing attacks)
         if (authToken) {
             const authHeader = req.headers.authorization;
@@ -705,6 +863,138 @@ export async function startHttpServer(server, kernelInstance, options) {
             }
             return;
         }
+        // POST /agents/register and /agents/heartbeat — generic local-runtime presence
+        // (swarm P2). The @decibel/hq SDK calls these so ANY local runtime (hermes,
+        // openclaw, codex, cursor, custom) appears on HQ's /agents board tagged with its
+        // runtime — generalizing the claude-peers presence path beyond Claude Code.
+        //
+        // IDENTITY = the localhost-bind connection principal (confused-deputy rule): only
+        // a LOCAL process may register a local runtime. We check the actual socket peer
+        // address (not a spoofable header). The runtime/session_key are untrusted LABELS
+        // from a trusted-LOCATION caller — fine for a local presence write. The hosted/BYO
+        // path uses an agent-token instead (P4), which is not this endpoint.
+        if ((path === '/agents/register' || path === '/agents/heartbeat') && req.method === 'POST') {
+            if (!isLocalAgentPeer(req)) {
+                sendJson(res, 403, wrapError('agents.register is local-only (the 127.0.0.1 bind is the principal). Hosted/BYO agents use the agent-token ingest path.', 'LOCAL_ONLY'));
+                return;
+            }
+            try {
+                const body = await parseBody(req);
+                const session_key = body.session_key;
+                const runtime = body.runtime;
+                if (!session_key || !runtime) {
+                    sendJson(res, 400, wrapError('Missing "session_key" and/or "runtime"', 'MISSING_FIELDS'));
+                    return;
+                }
+                const reqStatus = body.status === 'ended' ? 'ended' : 'active';
+                const ok = await writeLocalAgentSession({
+                    session_key,
+                    runtime,
+                    agent: body.agent ?? null,
+                    cwd: body.cwd ?? null,
+                    summary: body.summary ?? null,
+                    meta: body.meta ?? undefined,
+                    status: reqStatus,
+                });
+                if (!ok) {
+                    sendJson(res, 503, wrapError('Presence store unavailable (SUPABASE_URL/SERVICE_KEY not configured, or write failed).', 'PRESENCE_UNAVAILABLE'));
+                    return;
+                }
+                // Capability token: on 'ended' forget it; otherwise mint-or-return the
+                // session's token and hand it back so the SDK can authorize poll/ack. The
+                // token is the secret that distinguishes THIS registrant from any other
+                // co-resident local process guessing the (public) session_key.
+                let token;
+                if (reqStatus === 'ended') {
+                    dropSessionToken(session_key);
+                }
+                else {
+                    token = ensureSessionToken(session_key);
+                }
+                log(`HTTP: /agents/${path.endsWith('register') ? 'register' : 'heartbeat'} runtime=${runtime} session=${session_key}`);
+                sendJson(res, 200, wrapSuccess({ session_key, runtime, ok: true, ...(token && { token }) }));
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                sendJson(res, 400, wrapError(message, 'REGISTER_ERROR'));
+            }
+            return;
+        }
+        // GET /agents/commands?session_key=... — SDK command inbox poll (swarm onCommand).
+        // A local SDK runtime polls for HQ commands the dispatcher enqueued for it, runs
+        // onCommand, then acks via POST /agents/commands/ack. LOCALHOST-ONLY (same
+        // principal as register): the daemon holds the service_role; the SDK never does.
+        if (path === '/agents/commands' && req.method === 'GET') {
+            if (!isLocalAgentPeer(req)) {
+                sendJson(res, 403, wrapError('agent command inbox is local-only', 'LOCAL_ONLY'));
+                return;
+            }
+            const sessionKey = url.searchParams.get('session_key');
+            if (!sessionKey) {
+                sendJson(res, 400, wrapError('Missing "session_key" query param', 'MISSING_SESSION_KEY'));
+                return;
+            }
+            // Capability check: session_key is a guessable label, so a co-resident local
+            // process could otherwise drain another runtime's inbox. The token proves the
+            // caller is the registrant. Timing-safe compare; unknown session → no token →
+            // reject. (drainCommands also org-scopes — defense-in-depth on cross-org.)
+            const token = url.searchParams.get('token') || '';
+            const expected = getSessionToken(sessionKey);
+            if (!expected || !timingSafeTokenCompare(token, expected)) {
+                sendJson(res, 403, wrapError('Invalid or missing session token', 'BAD_SESSION_TOKEN'));
+                return;
+            }
+            const commands = drainCommands(sessionKey, ORG_ID);
+            sendJson(res, 200, wrapSuccess({ session_key: sessionKey, commands, count: commands.length }));
+            return;
+        }
+        // POST /agents/commands/ack — SDK reports a command's outcome; daemon settles the
+        // hq.agent_commands row in Core (service_role). LOCALHOST-ONLY. Only done|failed.
+        if (path === '/agents/commands/ack' && req.method === 'POST') {
+            if (!isLocalAgentPeer(req)) {
+                sendJson(res, 403, wrapError('agent command ack is local-only', 'LOCAL_ONLY'));
+                return;
+            }
+            try {
+                const body = await parseBody(req);
+                const id = body.id;
+                const status = body.status;
+                if (!id || (status !== 'done' && status !== 'failed')) {
+                    sendJson(res, 400, wrapError('Require "id" and "status" in {done|failed}', 'INVALID_ACK'));
+                    return;
+                }
+                // Capability check: only the session this command was enqueued for may ack
+                // it (else any local process could forge a 'done' + arbitrary result for
+                // another runtime's command). Map id→owning session, verify its token.
+                const owner = ackOwnerOf(id);
+                const expected = owner ? getSessionToken(owner) : undefined;
+                const token = typeof body.token === 'string' ? body.token : '';
+                if (!owner || !expected || !timingSafeTokenCompare(token, expected)) {
+                    sendJson(res, 403, wrapError('Ack not authorized for this command', 'BAD_SESSION_TOKEN'));
+                    return;
+                }
+                // Defense-in-depth: cap the forged-able result blob (1MB body limit already
+                // applies; this bounds a single field written to Core under service_role).
+                const result = body.result ?? null;
+                if (result && Buffer.byteLength(JSON.stringify(result)) > 64 * 1024) {
+                    sendJson(res, 400, wrapError('Ack "result" too large (max 64KB)', 'RESULT_TOO_LARGE'));
+                    return;
+                }
+                const errStr = typeof body.error === 'string' ? body.error : null;
+                const ok = await settleCommandFromAck(id, status, result, errStr);
+                if (!ok) {
+                    sendJson(res, 503, wrapError('Command store unavailable (Supabase not configured)', 'STORE_UNAVAILABLE'));
+                    return;
+                }
+                clearAckOwner(id);
+                sendJson(res, 200, wrapSuccess({ id, status, ok: true }));
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                sendJson(res, 400, wrapError(message, 'ACK_ERROR'));
+            }
+            return;
+        }
         // GET /agents — List connected agents
         if (path === '/agents' && req.method === 'GET') {
             if (!agentRegistry) {
@@ -823,6 +1113,7 @@ export async function startHttpServer(server, kernelInstance, options) {
                     scope: req.headers['x-scope'] || bodyContext.scope,
                     engagementMode: req.headers['x-engagement-mode'] || bodyContext.engagementMode,
                     userKey: req.headers['x-user-key'] || bodyContext.userKey,
+                    orgId: req.headers['x-org-key'] || bodyContext.orgId,
                     requestId: req.headers['x-request-id'] || bodyContext.requestId,
                     allowedFacades: bodyContext.allowedFacades,
                     tier,
@@ -1762,6 +2053,13 @@ export async function startHttpServer(server, kernelInstance, options) {
     httpServer.headersTimeout = timeoutMs + 1000; // Slightly longer than keepAliveTimeout
     httpServer.listen(port, host, () => {
         log(`HTTP Server listening on http://${host}:${port}`);
+        // Advertise port + pid in daemon.meta so clients can discover the daemon.
+        try {
+            setDaemonPort(port);
+        }
+        catch (err) {
+            log(`Daemon: failed to write port to meta: ${err instanceof Error ? err.message : String(err)}`);
+        }
         console.log(`
 ╔══════════════════════════════════════════════════════════════╗
 ║  Decibel MCP Server - HTTP Mode  v${PKG.version}${' '.repeat(Math.max(0, 24 - PKG.version.length))}║
@@ -1782,7 +2080,7 @@ export async function startHttpServer(server, kernelInstance, options) {
 ║    POST /mcp              Full MCP protocol                  ║
 ╠══════════════════════════════════════════════════════════════╣
 ║  Base URL: http://${host}:${port}${' '.repeat(Math.max(0, 40 - port.toString().length - host.length))}║
-${authToken ? '║  Auth:     Bearer token required                             ║' : '║  Auth:     None (use --auth-token for security)              ║'}
+${authToken ? '║  Auth:     Bearer token required                             ║' : '║  Auth:     None (set DECIBEL_AUTH_TOKEN env var)             ║'}
 ╠══════════════════════════════════════════════════════════════╣
 ║  SSE Settings:                                               ║
 ║    Keepalive:  ${sseKeepaliveMs}ms${' '.repeat(Math.max(0, 43 - sseKeepaliveMs.toString().length))}║
@@ -1837,13 +2135,23 @@ ${authToken ? '║  Auth:     Bearer token required
 export function parseHttpArgs(args) {
     const httpMode = args.includes('--http');
     const portIndex = args.indexOf('--port');
-    // Render sets PORT env var - use it if available
-    const defaultPort = process.env.PORT ? parseInt(process.env.PORT, 10) : 8787;
-    const port = portIndex !== -1 ? parseInt(args[portIndex + 1], 10) : defaultPort;
+    // --port flag wins; else honor PORT env (Render sets it); else leave undefined
+    // so daemonConfig's default (4888) applies downstream instead of being
+    // short-circuited by a baked-in default here. See server.ts port/host resolution.
+    const port = portIndex !== -1
+        ? parseInt(args[portIndex + 1], 10)
+        : process.env.PORT
+            ? parseInt(process.env.PORT, 10)
+            : undefined;
+    // SECURITY: Prefer env var for auth token (CLI args visible in ps/history)
+    // Fall back to --auth-token for backwards compatibility
     const authIndex = args.indexOf('--auth-token');
-    const authToken = authIndex !== -1 ? args[authIndex + 1] : undefined;
+    const authToken = process.env.DECIBEL_AUTH_TOKEN ||
+        (authIndex !== -1 ? args[authIndex + 1] : undefined);
     const hostIndex = args.indexOf('--host');
-    const host = hostIndex !== -1 ? args[hostIndex + 1] : '0.0.0.0';
+    // --host flag wins; else leave undefined so daemonConfig host (127.0.0.1, daemon
+    // mode) or the transport default applies instead of being short-circuited here.
+    const host = hostIndex !== -1 ? args[hostIndex + 1] : undefined;
     // SSE/Connection tuning arguments
     const keepaliveIndex = args.indexOf('--sse-keepalive');
     const sseKeepaliveMs = keepaliveIndex !== -1 ? parseInt(args[keepaliveIndex + 1], 10) : undefined;