@delt/claude-alarm 0.9.0 → 0.9.1

package/README.md

@@ -179,15 +179,40 @@ When Claude wants to run a tool (Bash, Write, Edit, etc.), a permission request
 - Local terminal prompt stays open; whichever answer arrives first (local or dashboard) is applied
 - Parsed previews: Bash commands show `$ command`, file operations show file paths
 
+## Authentication
+
+Every connection to the hub needs the hub token — including ones from the same machine.
+
+- **Channel servers** read it from `~/.claude-alarm/config.json` automatically (or `CLAUDE_ALARM_HUB_TOKEN`).
+- **Dashboard**: open the login link printed by `claude-alarm hub start` (`http://127.0.0.1:7900/?token=…`), or paste the token from `claude-alarm token` into the login form. The browser keeps an HttpOnly cookie for 30 days, and the token is removed from the URL.
+- **CLI / scripts**: send `Authorization: Bearer <token>`.
+
+> Upgrading from 0.9.x: a local session that sets `CLAUDE_ALARM_HUB_TOKEN` to a different value than the hub's token no longer connects. Scripts that called the local API without a token now get `401`.
+
 ## Remote Access
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/delt96/delt-claude-alarm/main/docs/remote-access.svg" alt="Remote Access" width="600">
 </p>
 
-1. Set host to `0.0.0.0` in `~/.claude-alarm/config.json`
-2. Open port 7900 in your firewall
-3. On remote machine: `claude-alarm init` → select remote hub (Y)
+Pick one:
+
+1. **Tailscale (recommended)** — set `host` to the hub machine's Tailscale IP and use that address from other machines. Traffic is encrypted and never exposed to the internet.
+2. **Cloudflare Tunnel / nginx with HTTPS** — keep `host: "127.0.0.1"` and point the tunnel or proxy at `http://127.0.0.1:7900`. The proxy must keep the browser's `Host` header (the hub rejects requests whose `Origin` doesn't match it), pass WebSocket upgrades, and forward `X-Forwarded-Proto` so the dashboard cookie is marked `Secure`. For nginx:
+
+   ```nginx
+   location / {
+     proxy_pass http://127.0.0.1:7900;
+     proxy_http_version 1.1;
+     proxy_set_header Host $host;
+     proxy_set_header Upgrade $http_upgrade;
+     proxy_set_header Connection "upgrade";
+     proxy_set_header X-Forwarded-Proto $scheme;
+   }
+   ```
+3. **Direct `0.0.0.0`** — set `host` to `0.0.0.0` and open port 7900. Traffic, including the token, is plain HTTP: use only on networks you trust.
+
+On the remote machine run `claude-alarm init` → select remote hub (Y), or configure:
 
 ```json
 {
@@ -196,7 +221,7 @@ When Claude wants to run a tool (Bash, Write, Edit, etc.), a permission request
       "command": "npx",
       "args": ["-y", "@delt/claude-alarm", "serve"],
       "env": {
-        "CLAUDE_ALARM_HUB_HOST": "your-server-ip",
+        "CLAUDE_ALARM_HUB_HOST": "your-hub-address",
         "CLAUDE_ALARM_HUB_PORT": "7900",
         "CLAUDE_ALARM_HUB_TOKEN": "your-token"
       }

package/dist/cli.js

@@ -696,6 +696,7 @@ ${previewHtml}${truncNote}`;
       }
       async handleCallbackQuery(query) {
         if (!query.data) return;
+        if (String(query.message?.chat.id) !== String(this.config.chatId)) return;
         if (query.data.startsWith("sess:")) {
           await this.handleSessionSelectCallback(query);
           return;
@@ -844,6 +845,69 @@ ${bodyLines.join("\n")}`;
   }
 });
 
+// src/hub/auth.ts
+import crypto from "crypto";
+function safeEqual(a, b) {
+  if (typeof a !== "string") return false;
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && crypto.timingSafeEqual(x, y);
+}
+function dashboardCookieValue(token) {
+  return crypto.createHmac("sha256", token).update("claude-alarm-dashboard").digest("hex");
+}
+function parseCookies(header) {
+  const out = {};
+  for (const part of (header ?? "").split(";")) {
+    const i = part.indexOf("=");
+    if (i <= 0) continue;
+    const raw = part.slice(i + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+    }
+    out[part.slice(0, i).trim()] = value;
+  }
+  return out;
+}
+function sessionCookieHeader(token, secure) {
+  return `${SESSION_COOKIE}=${dashboardCookieValue(token)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${COOKIE_MAX_AGE}${secure ? "; Secure" : ""}`;
+}
+function isAuthorized(req, token, allowQueryToken) {
+  const auth = req.headers.authorization;
+  if (auth?.startsWith("Bearer ") && safeEqual(auth.slice(7), token)) return true;
+  if (safeEqual(parseCookies(req.headers.cookie)[SESSION_COOKIE], dashboardCookieValue(token))) return true;
+  if (allowQueryToken) {
+    const q = new URL(req.url ?? "/", "http://hub").searchParams.get("token");
+    if (safeEqual(q, token)) return true;
+  }
+  return false;
+}
+function isCrossOrigin(req) {
+  const origin = req.headers.origin;
+  if (!origin) return false;
+  try {
+    return new URL(origin).host !== req.headers.host;
+  } catch {
+    return true;
+  }
+}
+function isJsonRequest(req) {
+  return String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json");
+}
+function isSecureRequest(req) {
+  return req.headers["x-forwarded-proto"] === "https";
+}
+var SESSION_COOKIE, COOKIE_MAX_AGE;
+var init_auth = __esm({
+  "src/hub/auth.ts"() {
+    "use strict";
+    SESSION_COOKIE = "ca_session";
+    COOKIE_MAX_AGE = 30 * 24 * 60 * 60;
+  }
+});
+
 // src/hub/server.ts
 var server_exports = {};
 __export(server_exports, {
@@ -855,7 +919,7 @@ import path4 from "path";
 import { fileURLToPath } from "url";
 import { WebSocketServer, WebSocket } from "ws";
 import { randomUUID as randomUUID3 } from "crypto";
-var __dirname, HubServer;
+var __dirname, MAX_WS_PAYLOAD, HubServer;
 var init_server = __esm({
   "src/hub/server.ts"() {
     "use strict";
@@ -866,7 +930,9 @@ var init_server = __esm({
     init_telegram();
     init_config();
     init_crash_guard();
+    init_auth();
     __dirname = path4.dirname(fileURLToPath(import.meta.url));
+    MAX_WS_PAYLOAD = 16 * 1024 * 1024;
     HubServer = class {
       httpServer;
       wssChannel;
@@ -884,6 +950,7 @@ var init_server = __esm({
       heartbeatInterval;
       channelAlive = /* @__PURE__ */ new Map();
       // sessionId -> alive flag
+      socketOwners = /* @__PURE__ */ new WeakMap();
       host;
       port;
       token;
@@ -906,22 +973,23 @@ var init_server = __esm({
           this.initTelegram(fullConfig.telegram);
         }
         this.httpServer = http.createServer((req, res) => this.handleHttp(req, res));
-        this.wssChannel = new WebSocketServer({ noServer: true });
+        this.wssChannel = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
         this.wssChannel.on("connection", (ws, req) => this.handleChannelConnection(ws, req));
         this.wssChannel.on("error", (err) => logger.warn(`Channel WebSocket server error: ${err.message}`));
-        this.wssDashboard = new WebSocketServer({ noServer: true });
+        this.wssDashboard = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD });
         this.wssDashboard.on("connection", (ws) => this.handleDashboardConnection(ws));
         this.wssDashboard.on("error", (err) => logger.warn(`Dashboard WebSocket server error: ${err.message}`));
         this.httpServer.on("upgrade", (req, socket, head) => {
           socket.on("error", (err) => logger.debug(`Upgrade socket error: ${err.message}`));
-          const url = new URL(req.url, `http://${req.headers.host}`);
+          const url = new URL(req.url ?? "/", "http://hub");
           const pathname = url.pathname;
-          if (this.token && !this.isLocalRequest(req)) {
-            const wsToken = url.searchParams.get("token");
-            if (wsToken !== this.token) {
-              socket.destroy();
-              return;
-            }
+          if (isCrossOrigin(req)) {
+            this.rejectUpgrade(socket, 403, "Forbidden", pathname, req);
+            return;
+          }
+          if (!this.authorized(req, true)) {
+            this.rejectUpgrade(socket, 401, "Unauthorized", pathname, req);
+            return;
           }
           if (pathname === WS_PATH_CHANNEL) {
             this.wssChannel.handleUpgrade(req, socket, head, (ws) => {
@@ -973,31 +1041,28 @@ var init_server = __esm({
       }
       // --- HTTP Handler ---
       handleHttp(req, res) {
-        const url = new URL(req.url, `http://${req.headers.host}`);
-        const origin = req.headers.origin;
-        if (origin && (origin.includes("127.0.0.1") || origin.includes("localhost"))) {
-          res.setHeader("Access-Control-Allow-Origin", origin);
-        }
-        res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-        if (req.method === "OPTIONS") {
-          res.writeHead(204);
-          res.end();
+        const url = new URL(req.url ?? "/", "http://hub");
+        if (isCrossOrigin(req)) {
+          this.jsonResponse(res, 403, { error: "Cross-origin request rejected" });
           return;
         }
-        if (url.pathname !== "/" && this.token) {
-          if (!this.isLocalRequest(req)) {
-            const authHeader = req.headers["authorization"];
-            const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-            if (bearerToken !== this.token) {
-              this.jsonResponse(res, 401, { error: "Unauthorized" });
-              return;
-            }
-          }
+        if (req.method === "POST" && !isJsonRequest(req)) {
+          this.jsonResponse(res, 415, { error: "Content-Type must be application/json" });
+          return;
         }
         if (url.pathname === "/" && req.method === "GET") {
-          this.serveDashboard(res);
-        } else if (url.pathname === "/api/sessions" && req.method === "GET") {
+          this.serveDashboard(req, res, url);
+          return;
+        }
+        if (url.pathname === "/api/login" && req.method === "POST") {
+          this.handleLogin(req, res);
+          return;
+        }
+        if (!this.authorized(req, false)) {
+          this.jsonResponse(res, 401, { error: "Unauthorized" });
+          return;
+        }
+        if (url.pathname === "/api/sessions" && req.method === "GET") {
           this.jsonResponse(res, 200, { sessions: this.sessions.getAll() });
         } else if (url.pathname === "/api/status" && req.method === "GET") {
           this.jsonResponse(res, 200, {
@@ -1048,7 +1113,13 @@ var init_server = __esm({
           this.jsonResponse(res, 404, { error: "Not found" });
         }
       }
-      serveDashboard(res) {
+      serveDashboard(req, res, url) {
+        const linkToken = url.searchParams.get("token");
+        if (linkToken !== null && this.token && safeEqual(linkToken, this.token)) {
+          res.writeHead(302, { Location: "/", "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+          res.end();
+          return;
+        }
         const candidates = [
           path4.join(__dirname, "..", "dashboard", "index.html"),
           // from dist/hub/
@@ -1075,6 +1146,20 @@ var init_server = __esm({
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
         res.end("<html><body><h1>claude-alarm</h1><p>Dashboard HTML not found. Reinstall the package.</p></body></html>");
       }
+      async handleLogin(req, res) {
+        const body = await this.readBody(req);
+        if (!this.token) {
+          res.writeHead(204);
+          res.end();
+          return;
+        }
+        if (typeof body?.token !== "string" || !safeEqual(body.token, this.token)) {
+          this.jsonResponse(res, 401, { error: "Unauthorized" });
+          return;
+        }
+        res.writeHead(204, { "Set-Cookie": sessionCookieHeader(this.token, isSecureRequest(req)) });
+        res.end();
+      }
       async handleApiSend(req, res) {
         const body = await this.readBody(req);
         if (!body) {
@@ -1151,6 +1236,22 @@ var init_server = __esm({
         });
       }
       handleChannelMessage(ws, isLocal, msg) {
+        if (msg.type === "register") {
+          const id = msg.session.id;
+          const owned = this.socketOwners.get(ws);
+          if (owned && owned !== id) {
+            logger.warn(`Rejected register for ${id}: connection already owns ${owned}`);
+            return;
+          }
+          const holder = this.channelSockets.get(id);
+          if (holder && holder !== ws) {
+            this.socketOwners.delete(holder);
+            holder.terminate();
+          }
+          this.socketOwners.set(ws, id);
+        } else if ("sessionId" in msg && this.socketOwners.get(ws) !== msg.sessionId) {
+          return;
+        }
         switch (msg.type) {
           case "register": {
             const session = msg.session;
@@ -1174,7 +1275,6 @@ var init_server = __esm({
             break;
           }
           case "peer_name": {
-            if (this.channelSockets.get(msg.sessionId) !== ws) break;
             const updated = this.sessions.setPeerName(msg.sessionId, msg.peerName);
             if (updated) {
               logger.info(`Peer name for ${msg.sessionId}: ${msg.peerName ?? "-"}`);
@@ -1502,6 +1602,18 @@ var init_server = __esm({
         res.writeHead(status, { "Content-Type": "application/json" });
         res.end(JSON.stringify(body));
       }
+      authorized(req, allowQueryToken) {
+        return !this.token || isAuthorized(req, this.token, allowQueryToken);
+      }
+      rejectUpgrade(socket, status, text, pathname, req) {
+        logger.warn(`Rejected ${pathname} upgrade (${status}) from ${req.socket.remoteAddress}`);
+        socket.write(`HTTP/1.1 ${status} ${text}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+        socket.destroy();
+      }
       isLocalRequest(req) {
         const addr = req.socket.remoteAddress;
         return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
@@ -1967,6 +2079,12 @@ import path7 from "path";
 import readline from "readline";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var __dirname2 = path7.dirname(fileURLToPath2(import.meta.url));
+function authHeaders(token) {
+  return token ? { Authorization: `Bearer ${token}` } : {};
+}
+function loginLink(displayHost, port, token) {
+  return `http://${displayHost}:${port}/${token ? `?token=${encodeURIComponent(token)}` : ""}`;
+}
 function printUsage() {
   console.log(`
 claude-alarm - Monitor Claude Code sessions with notifications
@@ -2014,7 +2132,7 @@ async function hubStart(daemon) {
   if (fs6.existsSync(PID_FILE)) {
     const pid = parseInt(fs6.readFileSync(PID_FILE, "utf-8").trim(), 10);
     if (isProcessRunning(pid)) {
-      console.log(`Hub is already running (PID: ${pid}) on http://${displayHost}:${port}`);
+      console.log(`Hub is already running (PID: ${pid}). Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
       return;
     }
     fs6.unlinkSync(PID_FILE);
@@ -2032,7 +2150,7 @@ async function hubStart(daemon) {
       fs6.writeFileSync(PID_FILE, String(child.pid), "utf-8");
       child.unref();
       console.log(`Hub started as daemon (PID: ${child.pid})`);
-      console.log(`Dashboard: http://${displayHost}:${port}`);
+      console.log(`Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
       console.log(`Token: ${config2.hub.token}`);
       console.log(`Logs: ${LOG_FILE}`);
     } else {
@@ -2041,6 +2159,7 @@ async function hubStart(daemon) {
     }
   } else {
     console.log(`Starting hub on http://${displayHost}:${port} (press Ctrl+C to stop)`);
+    console.log(`Dashboard: ${loginLink(displayHost, port, config2.hub.token)}`);
     console.log(`Token: ${config2.hub.token}`);
     console.log(`Logs: ${LOG_FILE}`);
     installCrashGuard("hub foreground");
@@ -2089,7 +2208,7 @@ async function hubStatus() {
     }
   }
   try {
-    const res = await fetch(`http://${host}:${port}/api/status`);
+    const res = await fetch(`http://${host}:${port}/api/status`, { headers: authHeaders(config2.hub.token) });
     if (res.ok) {
       const data = await res.json();
       console.log(`Hub: running (PID: ${data.pid})`);
@@ -2198,7 +2317,7 @@ claude-alarm init for "${projectName}"
     const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
     let hubRunning = false;
     try {
-      const res = await fetch(`http://${host}:${port}/api/status`);
+      const res = await fetch(`http://${host}:${port}/api/status`, { headers: authHeaders(config2.hub.token) });
       hubRunning = res.ok;
     } catch {
     }