@goodandready/dsh-goal 0.2.23 → 0.2.25

package/lib/engine-git-branch.js

@@ -7,11 +7,11 @@ import { getSafeCwd } from './goal-engine-constants.js';
  * @param {string} workspaceRoot
  * @returns {boolean}
  */
-export function isGitRepository(workspaceRoot) {
+export function isGitRepository(workspaceRoot, allowedRoots = []) {
   if (!workspaceRoot || typeof workspaceRoot !== 'string') return false;
   try {
-    const safePath = getSafeCwd(workspaceRoot);
-    if (!fs.existsSync(safePath)) return false;
+    const safePath = getSafeCwd(workspaceRoot, allowedRoots);
+    if (!safePath || !fs.existsSync(safePath)) return false;
     execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
       cwd: safePath,
       stdio: ['ignore', 'pipe', 'ignore'],
@@ -61,9 +61,9 @@ export function sanitizeBranchSlug(title) {
  * @param {string} cwd 
  * @returns {string} branch name or 'HEAD'
  */
-export function getCurrentGitBranch(cwd = process.cwd()) {
-  const safeCwd = getSafeCwd(cwd);
-  if (!isGitRepository(safeCwd)) return 'main';
+export function getCurrentGitBranch(cwd = process.cwd(), allowedRoots = []) {
+  const safeCwd = getSafeCwd(cwd, allowedRoots);
+  if (!safeCwd || !isGitRepository(safeCwd, allowedRoots)) return 'main';
   try {
     return execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
       cwd: safeCwd,
@@ -81,10 +81,10 @@ export function getCurrentGitBranch(cwd = process.cwd()) {
  * @param {string} branchName 
  * @returns {boolean} success
  */
-export function createGoalBranch(cwd = process.cwd(), branchName) {
+export function createGoalBranch(cwd = process.cwd(), branchName, allowedRoots = []) {
   if (!isValidGitRef(branchName)) return false;
-  const safeCwd = getSafeCwd(cwd);
-  if (!isGitRepository(safeCwd)) return false;
+  const safeCwd = getSafeCwd(cwd, allowedRoots);
+  if (!safeCwd || !isGitRepository(safeCwd, allowedRoots)) return false;
   try {
     execFileSync('git', ['checkout', '-b', branchName], {
       cwd: safeCwd,
@@ -104,12 +104,12 @@ export function createGoalBranch(cwd = process.cwd(), branchName) {
  * @param {string} targetBranch 
  * @returns {boolean} success
  */
-export function mergeGoalBranch(cwd = process.cwd(), branchName, targetBranch = 'main') {
+export function mergeGoalBranch(cwd = process.cwd(), branchName, targetBranch = 'main', allowedRoots = []) {
   if (!isValidGitRef(branchName) || !isValidGitRef(targetBranch)) return false;
-  const safeCwd = getSafeCwd(cwd);
-  if (!isGitRepository(safeCwd)) return false;
+  const safeCwd = getSafeCwd(cwd, allowedRoots);
+  if (!safeCwd || !isGitRepository(safeCwd, allowedRoots)) return false;
   try {
-    execFileSync('git', ['checkout', '--', targetBranch], {
+    execFileSync('git', ['checkout', targetBranch], {
       cwd: safeCwd,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -132,12 +132,12 @@ export function mergeGoalBranch(cwd = process.cwd(), branchName, targetBranch =
  * @param {string} targetBranch 
  * @returns {boolean} success
  */
-export function discardGoalBranch(cwd = process.cwd(), branchName, targetBranch = 'main') {
+export function discardGoalBranch(cwd = process.cwd(), branchName, targetBranch = 'main', allowedRoots = []) {
   if (!isValidGitRef(branchName) || !isValidGitRef(targetBranch)) return false;
-  const safeCwd = getSafeCwd(cwd);
-  if (!isGitRepository(safeCwd)) return false;
+  const safeCwd = getSafeCwd(cwd, allowedRoots);
+  if (!safeCwd || !isGitRepository(safeCwd, allowedRoots)) return false;
   try {
-    execFileSync('git', ['checkout', '--', targetBranch], {
+    execFileSync('git', ['checkout', targetBranch], {
       cwd: safeCwd,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],

package/lib/routes.js

@@ -8,31 +8,82 @@ import { parseIssueChecklist } from './engine-issue-sync.js';
 
 export function isLoopback(value) {
   if (!value) return false;
-  const address = String(value).toLowerCase().replace(/^\[|\]$/g, '');
+  let address = String(value).toLowerCase().replace(/^\[|\]$/g, '');
+  if (address.includes(':')) {
+    const colons = address.split(':').length - 1;
+    if (colons === 1) address = address.split(':')[0];
+  }
+  address = address.replace(/^::ffff:/, '');
   return Boolean(
     address === 'localhost' ||
     address === 'localhost.' ||
     address === '::1' ||
-    address.startsWith('127.') ||
-    address.startsWith('::ffff:127.')
+    address.startsWith('127.')
   );
 }
 
-export function isTrustedCaller(req) {
+export function isTrustedHost(val) {
+  if (!val || typeof val !== 'string') return false;
+  let hostname = val.trim().toLowerCase();
+  if (hostname.startsWith('[')) {
+    const end = hostname.indexOf(']');
+    if (end > 0) hostname = hostname.slice(1, end);
+  } else if (hostname.includes(':')) {
+    const colons = hostname.split(':').length - 1;
+    if (colons === 1) hostname = hostname.split(':')[0];
+  }
+  const clean = hostname.replace(/^::ffff:/, '');
+  if (clean === 'localhost' || clean === 'localhost.' || clean.endsWith('.local') || clean.endsWith('.lan')) return true;
+  if (clean === '127.0.0.1' || clean === '::1' || clean.startsWith('127.')) return true;
+  if (clean.startsWith('10.') || clean.startsWith('192.168.')) return true;
+  const match172 = clean.match(/^172\.(\d+)\./);
+  if (match172) {
+    const octet = parseInt(match172[1], 10);
+    if (octet >= 16 && octet <= 31) return true;
+  }
+  return false;
+}
+
+export function isTrustedCaller(req, authToken = process.env.DSH_GOAL_AUTH_TOKEN) {
   if (!req) return false;
-  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || "";
+  const rawRemote = req.socket?.remoteAddress || req.connection?.remoteAddress || "";
+  const cleanRemote = String(rawRemote).trim().toLowerCase().replace(/^::ffff:/, '');
   const site = req.headers?.["sec-fetch-site"];
 
   // 1. Cross-site and same-site browser requests are rejected
   if (site === "cross-site" || site === "same-site") return false;
 
-  // 2. Same-origin browser UI requests (operator UI on LAN or localhost)
+  // 2. If remoteAddress is present, it must be a trusted local/private IP (never untrusted WAN)
+  if (cleanRemote && !isTrustedHost(cleanRemote)) {
+    return false;
+  }
+
+  // 3. If Host header is present, it must be a trusted local/private host (DNS rebinding guard)
+  const host = String(req.headers?.host || "").trim().toLowerCase();
+  if (host && !isTrustedHost(host)) {
+    return false;
+  }
+
+  // 4. Optional authorization token check (supports x-dsh-auth-token or Authorization: Bearer <token>)
+  if (authToken) {
+    const headerVal = req.headers?.["x-dsh-auth-token"] || req.headers?.authorization;
+    const cleanHeader = headerVal ? String(headerVal).replace(/^Bearer\s+/i, "").trim() : "";
+    if (cleanHeader === authToken) {
+      return true;
+    }
+    // When authToken is explicitly configured, non-loopback callers without valid token are rejected
+    if (!isLoopback(cleanRemote)) {
+      return false;
+    }
+  }
+
+  // 5. Same-origin browser UI requests (operator UI on LAN or localhost)
   if (site === "same-origin") {
-    const host = String(req.headers?.host || "").toLowerCase();
     const origin = String(req.headers?.origin || "").trim().toLowerCase();
     if (origin && host) {
       try {
         const u = new URL(origin);
+        if (!isTrustedHost(u.hostname)) return false;
         if (u.host === host) return true;
       } catch (err) {
         return false;
@@ -42,6 +93,7 @@ export function isTrustedCaller(req) {
     if (referer && host) {
       try {
         const u = new URL(referer);
+        if (!isTrustedHost(u.hostname)) return false;
         if (u.host === host) return true;
       } catch (err) {
         return false;
@@ -50,12 +102,12 @@ export function isTrustedCaller(req) {
     return false;
   }
 
-  // 3. No declared site: only loopback remote clients (CLI, reverse proxy) are trusted
-  if (isLoopback(remote)) return true;
+  // 6. No declared site: only loopback remote clients (CLI, reverse proxy) are trusted
+  if (isLoopback(cleanRemote)) return true;
 
-  // 4. Fallback for test harnesses without remote socket where host header explicitly targets loopback
-  if (!remote && req.headers?.host) {
-    const hostName = String(req.headers.host).split(":")[0];
+  // 7. Fallback for test harnesses without remote socket where host header explicitly targets loopback
+  if (!cleanRemote && host) {
+    const hostName = host.split(":")[0];
     if (isLoopback(hostName)) {
       return true;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-goal",
-  "version": "0.2.23",
+  "version": "0.2.25",
   "description": "Core Goal Addon (Token Budget, Milestones, Git Snapshots & Retrospective Reports) for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",