@kendoo.agentdesk/agentdesk 0.25.0 → 0.25.2

package/cli/daemon.mjs

@@ -92,7 +92,16 @@ function logSessionMetadata(sessionId, metadata) {
 
 // --- Find project on local filesystem ---
 
+// AD-47: server-pushed projectName flows into path.join() here. Validate
+// against a strict character set so values like "../../etc" can't stat
+// arbitrary host paths or land in projects.json with traversal sequences
+// for later use.
+const PROJECT_NAME_RE = /^[A-Za-z0-9._-]{1,64}$/;
+
 function findProjectLocally(projectName) {
+  if (!PROJECT_NAME_RE.test(String(projectName || ""))) {
+    return null;
+  }
   const home = process.env.HOME || process.env.USERPROFILE;
   // Search common code directories for a folder matching the project name
   const searchRoots = [

package/cli/login.mjs

@@ -81,11 +81,12 @@ export async function runLogin() {
 
   const state = randomUUID();
 
-  // Start a local server to receive the API key callback
+  // Start a local server to receive the API key callback. AD-48: no CORS
+  // headers — the dashboard hits this endpoint as a top-level navigation
+  // (window.location.href = ...), which doesn't require CORS. Removing the
+  // wildcard ACAO closes the timing oracle that let any origin XHR-probe
+  // whether a login was in progress on this port.
   const server = createServer((req, res) => {
-    // Allow CORS from agentdesk.live
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
     if (req.method === "OPTIONS") { res.writeHead(200); res.end(); return; }
 
     const url = new URL(req.url, `http://localhost`);

package/cli/screenshot.mjs

@@ -31,9 +31,27 @@ async function loadPuppeteer() {
   try {
     return await import("puppeteer");
   } catch {
-    console.log("Installing puppeteer...");
-    const { execSync } = await import("child_process");
-    execSync("npm install --no-save puppeteer", { stdio: "inherit" });
+    // AD-50: require explicit consent before installing puppeteer (a ~200 MB
+    // dependency that pulls in a Chromium download). Previously this ran
+    // silently on first screenshot — surprising, and a supply-chain compromise
+    // of puppeteer would have applied transparently.
+    if (process.env.AGENTDESK_SCREENSHOT_AUTO_INSTALL === "1") {
+      console.log("Installing puppeteer (AGENTDESK_SCREENSHOT_AUTO_INSTALL=1)...");
+    } else if (process.stdin.isTTY) {
+      const { createInterface } = await import("readline");
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      const answer = await new Promise(resolve =>
+        rl.question("Screenshot requires puppeteer (~200 MB). Install now? [y/N] ", resolve)
+      );
+      rl.close();
+      if (!/^y(es)?$/i.test(String(answer).trim())) {
+        throw new Error("Puppeteer install declined. Re-run with AGENTDESK_SCREENSHOT_AUTO_INSTALL=1 to skip this prompt.");
+      }
+    } else {
+      throw new Error("puppeteer is not installed and no terminal is available to confirm. Set AGENTDESK_SCREENSHOT_AUTO_INSTALL=1 to install non-interactively.");
+    }
+    const { execFileSync } = await import("child_process");
+    execFileSync("npm", ["install", "--no-save", "puppeteer"], { stdio: "inherit" });
     return await import("puppeteer");
   }
 }

package/cli/session-sandbox.mjs

@@ -24,6 +24,16 @@ import { join } from "path";
 import { tmpdir } from "os";
 import { randomUUID } from "crypto";
 
+// AD-46: refuse any value with embedded newlines before it lands in YAML or
+// gitconfig. Real GitHub PATs / emails / names won't have them, but a server-
+// pushed identity field with a stray \n could inject an extra config line.
+function assertNoNewline(name, value) {
+  if (typeof value !== "string") return;
+  if (/[\r\n]/.test(value)) {
+    throw new Error(`Refusing to write scratch config: ${name} contains a newline`);
+  }
+}
+
 export function createScratchHome({ projectId, sessionId, creds = {}, commitIdentity = {} }) {
   if (!creds.GITHUB_TOKEN) {
     // Caller is responsible for running session-preflight before reaching
@@ -31,6 +41,10 @@ export function createScratchHome({ projectId, sessionId, creds = {}, commitIden
     // fail loudly instead.
     throw new Error("createScratchHome called without GITHUB_TOKEN — preflight should have caught this");
   }
+  // AD-46: validate inputs before they're concatenated into structured files.
+  assertNoNewline("GITHUB_TOKEN", creds.GITHUB_TOKEN);
+  assertNoNewline("commitIdentity.name", commitIdentity.name);
+  assertNoNewline("commitIdentity.email", commitIdentity.email);
 
   const base = join(tmpdir(), "agentdesk-sessions", `${safe(projectId)}-${sessionId || randomUUID().slice(0, 8)}`);
   const ghConfigDir = join(base, "gh");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.25.0",
+  "version": "0.25.2",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {