@jhizzard/termdeck 0.3.4 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jhizzard/termdeck",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Browser-based terminal multiplexer with metadata overlays, panel flashback memory recall, and AI-aware session management",
   "bin": {
     "termdeck": "./packages/cli/src/index.js"

package/packages/server/src/auth.js

@@ -156,9 +156,17 @@ function verifyWebSocketUpgrade(config, req) {
   return !!provided && provided === token;
 }
 
+// Whether a usable auth token is configured (via config.auth.token or the
+// TERMDECK_AUTH_TOKEN env var). Used by the bind guardrail in index.js to
+// decide whether binding to a non-localhost interface is permitted.
+function hasAuth(config) {
+  return !!getConfiguredToken(config);
+}
+
 module.exports = {
   createAuthMiddleware,
   verifyWebSocketUpgrade,
   getConfiguredToken,
+  hasAuth,
   loginPage
 };

package/packages/server/src/index.js

@@ -60,7 +60,7 @@ const { TranscriptWriter } = require('./transcripts');
 const { createHealthHandler } = require('./preflight');
 const { themes, statusColors } = require('./themes');
 const { loadConfig, addProject } = require('./config');
-const { createAuthMiddleware, verifyWebSocketUpgrade } = require('./auth');
+const { createAuthMiddleware, verifyWebSocketUpgrade, hasAuth } = require('./auth');
 
 function createServer(config) {
   const app = express();
@@ -852,10 +852,23 @@ if (require.main === module) {
     config.sessionLogs = { ...(config.sessionLogs || {}), enabled: true };
   }
 
-  const { server, transcriptWriter } = createServer(config);
   const port = config.port || 3000;
   const host = config.host || '127.0.0.1';
 
+  // Bind guardrail (Sprint 10 T1): refuse to start on a non-localhost
+  // interface unless an auth token is configured. Binding 0.0.0.0 without
+  // auth is equivalent to publishing a root shell on the LAN — fail closed.
+  if (host !== '127.0.0.1' && host !== 'localhost' && host !== '::1') {
+    if (!hasAuth(config)) {
+      console.error('[security] Refusing to bind to ' + host + ' without auth.token set.');
+      console.error('[security] Set auth.token in ~/.termdeck/config.yaml or TERMDECK_AUTH_TOKEN env var.');
+      console.error('[security] To bind locally only, remove the host setting or set host: 127.0.0.1');
+      process.exit(1);
+    }
+  }
+
+  const { server, transcriptWriter } = createServer(config);
+
   // Graceful shutdown — flush transcript buffer before exit
   let shutdownInProgress = false;
   async function handleShutdown(signal) {