@kendoo.agentdesk/agentdesk 0.24.0 → 0.25.1

package/cli/daemon.mjs

@@ -92,7 +92,16 @@ function logSessionMetadata(sessionId, metadata) {
 
 // --- Find project on local filesystem ---
 
+// AD-47: server-pushed projectName flows into path.join() here. Validate
+// against a strict character set so values like "../../etc" can't stat
+// arbitrary host paths or land in projects.json with traversal sequences
+// for later use.
+const PROJECT_NAME_RE = /^[A-Za-z0-9._-]{1,64}$/;
+
 function findProjectLocally(projectName) {
+  if (!PROJECT_NAME_RE.test(String(projectName || ""))) {
+    return null;
+  }
   const home = process.env.HOME || process.env.USERPROFILE;
   // Search common code directories for a folder matching the project name
   const searchRoots = [
@@ -318,6 +327,27 @@ export async function runDaemon() {
     }
   }
 
+// AD-34 confirmation helper. Prints session details and asks y/N at the local
+// terminal. Returns true if the user accepts. If stdin isn't a TTY (running
+// headless / no terminal), refuse — the safer default. Set
+// AGENTDESK_DAEMON_AUTO_ACCEPT=1 to skip this prompt for trusted automation.
+async function confirmIncomingSession({ project, taskId, prompt }) {
+  if (!process.stdin.isTTY) {
+    console.log("  Refusing server-pushed session: no terminal to confirm at. Set AGENTDESK_DAEMON_AUTO_ACCEPT=1 to allow.");
+    return false;
+  }
+  const promptPreview = String(prompt || "(no prompt)").trim().slice(0, 240).replace(/\s+/g, " ");
+  console.log("");
+  console.log(`  Incoming session for project: ${project.name}`);
+  if (taskId) console.log(`  Task: ${taskId}`);
+  console.log(`  Prompt: ${promptPreview}${String(prompt || "").length > 240 ? "..." : ""}`);
+  console.log("");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise(resolve => rl.question("  Approve this session? [y/N] ", resolve));
+  rl.close();
+  return /^y(es)?$/i.test(String(answer).trim());
+}
+
   // 4. Session handling
 
   async function handleStartSession({ sessionId, projectId, taskId: remoteTaskId, prompt, phased, screenshots: screenshotsOverride }) {
@@ -329,6 +359,21 @@ export async function runDaemon() {
       return;
     }
 
+    // AD-34: server-pushed sessions get a human confirmation prompt at the
+    // local terminal before any code runs. If an attacker steals the user's
+    // api_key, they can POST to /api/daemon/sessions, but cannot push a
+    // command through to the victim machine without someone at the keyboard
+    // saying yes. Opt out via AGENTDESK_DAEMON_AUTO_ACCEPT=1 for trusted
+    // automation environments.
+    if (process.env.AGENTDESK_DAEMON_AUTO_ACCEPT !== "1") {
+      const accepted = await confirmIncomingSession({ project, taskId: remoteTaskId, prompt });
+      if (!accepted) {
+        console.log(`  ${yellow}Rejected by user:${reset} ${dim}${sessionId}${reset}`);
+        send({ type: "daemon:error", sessionId, error: "Session declined by daemon owner" });
+        return;
+      }
+    }
+
     // Enforce max 1 concurrent session — set flag BEFORE any async work to prevent race
     if (activeSession) {
       console.log(`  ${red}Rejected:${reset} session already running ${dim}(${activeSession.sessionId})${reset}`);

package/cli/login.mjs

@@ -81,11 +81,12 @@ export async function runLogin() {
 
   const state = randomUUID();
 
-  // Start a local server to receive the API key callback
+  // Start a local server to receive the API key callback. AD-48: no CORS
+  // headers — the dashboard hits this endpoint as a top-level navigation
+  // (window.location.href = ...), which doesn't require CORS. Removing the
+  // wildcard ACAO closes the timing oracle that let any origin XHR-probe
+  // whether a login was in progress on this port.
   const server = createServer((req, res) => {
-    // Allow CORS from agentdesk.live
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
     if (req.method === "OPTIONS") { res.writeHead(200); res.end(); return; }
 
     const url = new URL(req.url, `http://localhost`);

package/cli/session-sandbox.mjs

@@ -24,6 +24,16 @@ import { join } from "path";
 import { tmpdir } from "os";
 import { randomUUID } from "crypto";
 
+// AD-46: refuse any value with embedded newlines before it lands in YAML or
+// gitconfig. Real GitHub PATs / emails / names won't have them, but a server-
+// pushed identity field with a stray \n could inject an extra config line.
+function assertNoNewline(name, value) {
+  if (typeof value !== "string") return;
+  if (/[\r\n]/.test(value)) {
+    throw new Error(`Refusing to write scratch config: ${name} contains a newline`);
+  }
+}
+
 export function createScratchHome({ projectId, sessionId, creds = {}, commitIdentity = {} }) {
   if (!creds.GITHUB_TOKEN) {
     // Caller is responsible for running session-preflight before reaching
@@ -31,6 +41,10 @@ export function createScratchHome({ projectId, sessionId, creds = {}, commitIden
     // fail loudly instead.
     throw new Error("createScratchHome called without GITHUB_TOKEN — preflight should have caught this");
   }
+  // AD-46: validate inputs before they're concatenated into structured files.
+  assertNoNewline("GITHUB_TOKEN", creds.GITHUB_TOKEN);
+  assertNoNewline("commitIdentity.name", commitIdentity.name);
+  assertNoNewline("commitIdentity.email", commitIdentity.email);
 
   const base = join(tmpdir(), "agentdesk-sessions", `${safe(projectId)}-${sessionId || randomUUID().slice(0, 8)}`);
   const ghConfigDir = join(base, "gh");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.24.0",
+  "version": "0.25.1",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {