@goodandready/dsh-goal 0.2.7 → 0.2.9

package/lib/client.js

@@ -4685,7 +4685,7 @@ window.__ModuleLoader__.load({
 
       };
 
-    module.exports.inject = ['slots', 'locale', 'settingsScope'];
+    module.exports.inject = ['slots', 'locale', 'configForms'];
 
     module.exports.apply = function apply(ctx) {
       if (typeof ctx.effect === 'function') {
@@ -4694,9 +4694,9 @@ window.__ModuleLoader__.load({
             ctx.locale?.register?.(NS, LOCALES);
           } catch (err) { /* handled defensively */ }
 
-          const settingsScope =
-            ctx.settingsScope && typeof ctx.settingsScope.bind === 'function'
-              ? ctx.settingsScope.bind({ namespace: NS })
+          const configForms =
+            ctx.configForms && typeof ctx.configForms.get === 'function'
+              ? ctx.configForms.get(NS)
               : null;
 
           const disposers = [];
@@ -4736,7 +4736,7 @@ window.__ModuleLoader__.load({
               order: 60,
               label: () => 'Goal',
               locale: NS,
-              inject: () => ({ ctx, scope: settingsScope }),
+              inject: () => ({ ctx, scope: configForms }),
             },
             GoalSettingsCard,
           );
@@ -4747,7 +4747,7 @@ window.__ModuleLoader__.load({
               name: 'plugins.row.config',
               key: ROW_CONFIG_KEY,
               locale: NS,
-              inject: () => ({ ctx, scope: settingsScope }),
+              inject: () => ({ ctx, scope: configForms }),
             },
             GoalSettingsCard,
           );
@@ -4758,7 +4758,7 @@ window.__ModuleLoader__.load({
               name: 'settings.plugin.item',
               key: NS,
               locale: NS,
-              inject: () => ({ ctx, scope: settingsScope }),
+              inject: () => ({ ctx, scope: configForms }),
             },
             GoalSettingsCard,
           );
@@ -4774,9 +4774,9 @@ window.__ModuleLoader__.load({
           ctx.locale?.register?.(NS, LOCALES);
         } catch (err) { /* handled defensively */ }
 
-        const settingsScope =
-          ctx.settingsScope && typeof ctx.settingsScope.bind === 'function'
-            ? ctx.settingsScope.bind({ namespace: NS })
+        const configForms =
+          ctx.configForms && typeof ctx.configForms.get === 'function'
+            ? ctx.configForms.get(NS)
             : null;
 
         const registerSlotSafe = (name, entry, comp) => {
@@ -4813,7 +4813,7 @@ window.__ModuleLoader__.load({
             order: 60,
             label: () => 'Goal',
             locale: NS,
-            inject: () => ({ ctx, scope: settingsScope }),
+            inject: () => ({ ctx, scope: configForms }),
           },
           GoalSettingsCard,
         );
@@ -4824,7 +4824,7 @@ window.__ModuleLoader__.load({
             name: 'plugins.row.config',
             key: ROW_CONFIG_KEY,
             locale: NS,
-            inject: () => ({ ctx, scope: settingsScope }),
+            inject: () => ({ ctx, scope: configForms }),
           },
           GoalSettingsCard,
         );
@@ -4835,7 +4835,7 @@ window.__ModuleLoader__.load({
             name: 'settings.plugin.item',
             key: NS,
             locale: NS,
-            inject: () => ({ ctx, scope: settingsScope }),
+            inject: () => ({ ctx, scope: configForms }),
           },
           GoalSettingsCard,
         );

package/lib/goal-engine.js

@@ -225,6 +225,7 @@ export class GoalEngine {
       title: cleanTitle,
       description: options.description?.trim() || '',
       lang: options.lang || detectLanguage(cleanTitle),
+      cwd: options.cwd ? String(options.cwd).trim() : null,
       state: GoalState.RUNNING,
       startedAt: now,
       pausedAt: null,

package/lib/routes.js

@@ -3,16 +3,82 @@ import path from 'node:path';
 import { MilestoneStatus, detectLanguage, sessionIdOf } from './goal-engine-constants.js';
 import { saveGoalArtifact, rollbackToCheckpoint } from './engine-reports.js';
 
-function getSafeCwd(requestedCwd) {
-  if (!requestedCwd || typeof requestedCwd !== 'string') {
-    return process.cwd();
+export function isLoopback(value) {
+  if (!value) return false;
+  const address = String(value).toLowerCase().replace(/^\[|\]$/g, '');
+  return Boolean(
+    address === 'localhost' ||
+    address === 'localhost.' ||
+    address === '::1' ||
+    address.startsWith('127.') ||
+    address.startsWith('::ffff:127.')
+  );
+}
+
+export function isTrustedCaller(req) {
+  if (!req) return false;
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || '';
+  if (isLoopback(remote)) return true;
+
+  const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase();
+  if (secSite === 'same-origin' || secSite === 'same-site' || secSite === 'none') return true;
+  if (secSite === 'cross-site') return false;
+
+  const host = String(req.headers?.host || '').toLowerCase();
+  const origin = String(req.headers?.origin || '').trim().toLowerCase();
+  if (origin) {
+    try {
+      const u = new URL(origin);
+      if (u.host === host) return true;
+    } catch (err) { /* invalid url */ }
+    return false;
+  }
+
+  const referer = String(req.headers?.referer || '').trim().toLowerCase();
+  if (referer) {
+    try {
+      const u = new URL(referer);
+      if (u.host === host) return true;
+    } catch (err) { /* invalid url */ }
+    return false;
   }
+
+  // Fallback for tests or local CLI without socket where host header targets loopback
+  if (!remote && host) {
+    const hostName = host.split(':')[0];
+    if (isLoopback(hostName)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+export function isPathInsideOrEqual(parent, child) {
+  if (!parent || !child) return false;
+  const rel = path.relative(path.resolve(parent), path.resolve(child));
+  return !rel || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+
+export function getSafeCwd(requestedCwd, allowedRoots = []) {
+  const defaultRoot = allowedRoots[0] || process.cwd();
+  if (!requestedCwd || typeof requestedCwd !== 'string' || !requestedCwd.trim()) {
+    return defaultRoot;
+  }
+
   try {
     const resolved = path.resolve(requestedCwd.trim());
     const st = fs.statSync(resolved);
     if (!st.isDirectory()) {
       return null;
     }
+
+    const roots = allowedRoots.length > 0 ? allowedRoots : [process.cwd()];
+    const isAllowed = roots.some((root) => isPathInsideOrEqual(root, resolved));
+    if (!isAllowed) {
+      return null;
+    }
+
     return resolved;
   } catch (err) {
     return null;
@@ -144,8 +210,8 @@ export function registerRoutes(ctx, {
             return res.end(JSON.stringify({ error: 'Forbidden: cross-site requests are rejected' }));
           }
 
-          const origin = req.headers.origin;
-          const host = req.headers.host;
+          const origin = req.headers?.origin;
+          const host = req.headers?.host;
           if (origin && host) {
             try {
               const originHost = new URL(origin).host;
@@ -159,6 +225,11 @@ export function registerRoutes(ctx, {
             }
           }
 
+          if (!isTrustedCaller(req)) {
+            res.statusCode = 403;
+            return res.end(JSON.stringify({ error: 'Forbidden: untrusted caller origin' }));
+          }
+
           let body = '';
           let bodySize = 0;
           const MAX_PAYLOAD_BYTES = 256 * 1024;
@@ -196,6 +267,7 @@ export function registerRoutes(ctx, {
                     description: typeof description === 'string' ? description.trim() : '',
                     maxIterations: conf.maxIterations || 25,
                     lang: detectedLang,
+                    cwd: data.cwd,
                   }, sid);
 
                   const startPrompt = detectedLang === 'zh'
@@ -309,8 +381,11 @@ export function registerRoutes(ctx, {
                     res.statusCode = 400;
                     return res.end(JSON.stringify({ error: 'commit hash is required for rollback' }));
                   }
-                  const safeCwd = getSafeCwd(data.cwd);
-                  if (data.cwd && !safeCwd) {
+                  const sessionGoal = engine.getGoal(sid);
+                  const allowedRoots = [process.cwd()];
+                  if (sessionGoal?.cwd) allowedRoots.push(sessionGoal.cwd);
+                  const safeCwd = getSafeCwd(data.cwd, allowedRoots);
+                  if (!safeCwd) {
                     res.statusCode = 400;
                     return res.end(JSON.stringify({ error: 'Invalid or non-existent working directory' }));
                   }
@@ -329,8 +404,11 @@ export function registerRoutes(ctx, {
                     res.statusCode = 404;
                     return res.end(JSON.stringify({ error: 'No active goal to save artifact for' }));
                   }
-                  const safeCwd = getSafeCwd(data.cwd);
-                  if (data.cwd && !safeCwd) {
+                  const sessionGoal = engine.getGoal(sid);
+                  const allowedRoots = [process.cwd()];
+                  if (sessionGoal?.cwd) allowedRoots.push(sessionGoal.cwd);
+                  const safeCwd = getSafeCwd(data.cwd, allowedRoots);
+                  if (!safeCwd) {
                     res.statusCode = 400;
                     return res.end(JSON.stringify({ error: 'Invalid or non-existent working directory' }));
                   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-goal",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Autonomous Goal Execution & Multi-Turn Task Tracking Engine with Sticky Header for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",
@@ -45,7 +45,11 @@
     },
     "client": {
       "platform": "web",
-      "inject": []
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
     }
   },
   "peerDependencies": {