@klhapp/skillmux 1.9.0 → 1.9.2

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.9.2](https://github.com/klhq/skillmux/compare/v1.9.1...v1.9.2) (2026-08-30)
+
+
+### Fixed
+
+* **install:** refuse a file:// source without --allow-local-source (SMX-92) ([#156](https://github.com/klhq/skillmux/issues/156)) ([b4ffb4a](https://github.com/klhq/skillmux/commit/b4ffb4abec90f900113bcd5806274b5d5692d23c))
+* **server:** bound rate-limiter bucket map with LRU eviction (SMX-93) ([#155](https://github.com/klhq/skillmux/issues/155)) ([4dd1eb5](https://github.com/klhq/skillmux/commit/4dd1eb5a6d673f11f4ccd556fb4f189cf5fa828f))
+* **server:** compare fixed-length hashes in safeTokenEquals (SMX-94) ([#157](https://github.com/klhq/skillmux/issues/157)) ([ae225c0](https://github.com/klhq/skillmux/commit/ae225c0db88952fedd4e66d4f373455774635900))
+* **server:** refuse to bind a non-loopback host with auth disabled (SMX-91) ([#153](https://github.com/klhq/skillmux/issues/153)) ([2520408](https://github.com/klhq/skillmux/commit/252040867ed73ef1b82c6f97010842a9b399b498))
+
+## [1.9.1](https://github.com/klhq/skillmux/compare/v1.9.0...v1.9.1) (2026-08-30)
+
+
+### Fixed
+
+* **install:** reject '.' / '..' skill ids derived during install (path traversal) ([#151](https://github.com/klhq/skillmux/issues/151)) ([2426613](https://github.com/klhq/skillmux/commit/2426613b79c67e2afa267de946492b6b020011bb))
+* **install:** reject scp-like git URLs starting with '-' (argument injection RCE) ([#148](https://github.com/klhq/skillmux/issues/148)) ([6a9db28](https://github.com/klhq/skillmux/commit/6a9db28670201237dd17455592fa30cbce43b58f))
+* **sync:** require approval before creating a new target directory ([#152](https://github.com/klhq/skillmux/issues/152)) ([6fcfd1a](https://github.com/klhq/skillmux/commit/6fcfd1a8beed87e5f88e2bd24b84a94a3adb3d89))
+* **update:** validate skill-id against SKILL_ID_PATTERN before path-joining it ([#150](https://github.com/klhq/skillmux/issues/150)) ([0bfa807](https://github.com/klhq/skillmux/commit/0bfa8071a80ea4f70b2e6974cb2cb439666f8357))
+
 ## [1.9.0](https://github.com/klhq/skillmux/compare/v1.8.0...v1.9.0) (2026-08-30)
 
 

package/docs/deployment.md

@@ -232,6 +232,16 @@ Keep `trust_proxy = false` unless a trusted reverse proxy overwrites
 `X-Forwarded-For`. A client can spoof that header when it reaches Skillmux
 directly.
 
+`skillmux serve --transport http` enforces this itself: it refuses to bind a
+non-loopback hostname (including Docker's default `0.0.0.0`) while
+`auth_enabled` is `false`, since that combination leaves `/mcp` and `/stats`
+open to anyone who can reach the port. `skillmux doctor` flags the same
+combination as `server_bind_posture`. If you're relying on network-level
+isolation instead of application auth — e.g. a container with no published
+port, reachable only inside a private Docker network — set
+`SKILLMUX_ALLOW_INSECURE_BIND=true` to start anyway; the server logs a loud
+warning each time it does.
+
 ## Health and metrics
 
 The HTTP server provides:

package/docs/skill-management.md

@@ -42,6 +42,17 @@ skillmux install owner/repo --fail-on high
 The scanner detects suspicious prompt-injection patterns, secrets, and risky
 instructions. Findings remain advisory unless you pass `--fail-on`.
 
+`install` refuses a `file://` source by default — a `file://` URL reaches the
+local filesystem directly, so honoring one unconditionally would let anything
+that can hand `skillmux install` a string (a webpage, another tool's output,
+an instruction an agent was told to follow) pull an arbitrary local
+repository into the shared vault. Pass `--allow-local-source` when installing
+from a local repo is a deliberate, interactive choice:
+
+```sh
+skillmux install file:///path/to/local/repo --allow-local-source
+```
+
 ## Scan a vault or candidate
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@klhapp/skillmux",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "Skill management and retrieval for AI agents: sync native skills across clients and route the long tail over MCP",
   "type": "module",
   "private": false,

package/src/cli.ts

@@ -42,6 +42,7 @@ import {
   cloneToTemp,
   deriveRepoName,
   installIntoVault,
+  isLocalFileUrl,
   resolveCloneCommit,
   resolveRepoSource,
   resolveSkillDir,
@@ -82,10 +83,12 @@ import {
 import { getStats, renderStatsText, type StatsResponse } from "./stats";
 import {
   installPostMergeHook,
+  resolveProjectPinDir,
   restoreMonolith as restoreMonolithTarget,
   syncProjectTargets,
   syncTarget,
   writeLocalVaultMarker,
+  type ProjectGroupInput,
 } from "./sync";
 import { scanVault, vaultResolutionOrder } from "./vault";
 
@@ -771,21 +774,45 @@ function parseSyncArgs(args: string[]): {
   dryRun: boolean;
   restoreMonolith: boolean;
   installHook: boolean;
+  yes: boolean;
 } {
   let dryRun = false;
   let restoreMonolith = false;
   let installHook = false;
+  let yes = false;
   for (const arg of args) {
     if (arg === "--dry-run") dryRun = true;
     else if (arg === "--restore-monolith") restoreMonolith = true;
     else if (arg === "--install-hook") installHook = true;
+    else if (arg === "--yes") yes = true;
     else throw new Error(`unknown sync option: ${arg}`);
   }
-  return { dryRun, restoreMonolith, installHook };
+  return { dryRun, restoreMonolith, installHook, yes };
+}
+
+/**
+ * A target directory that doesn't exist yet is about to be created by `sync`.
+ * `manifest.targets[*].dir` is vault content — readable and writable by whatever
+ * populated the vault (a shared git-backed vault pulled in, or a hand-edit) — and
+ * `sync` can run unattended via the `--install-hook` post-merge hook. Without this
+ * gate, a tampered manifest naming a brand-new path gets that directory silently
+ * created (and populated with symlinks) the next time anyone pulls. Creation for
+ * an as-yet-unseen directory therefore requires either `--yes` or an interactive
+ * confirmation; once the directory exists, later syncs never hit this path again.
+ */
+async function confirmNewSyncTarget(label: string, dir: string, yes: boolean): Promise<boolean> {
+  if (yes) return true;
+  if (!isInteractive()) {
+    console.log(
+      `${label}: skipped — ${dir} does not exist yet; creating it requires approval. Re-run "skillmux sync --yes", or run "skillmux sync" interactively, once you've confirmed this target is expected.`,
+    );
+    return false;
+  }
+  return confirmAction(`${label}: create new target directory ${dir}?`);
 }
 
 async function runSync(args: string[]): Promise<void> {
-  const { dryRun, restoreMonolith, installHook } = parseSyncArgs(args);
+  const { dryRun, restoreMonolith, installHook, yes } = parseSyncArgs(args);
   const config = await loadConfig();
   const vaultPath = expandHome(config.vault_path);
 
@@ -829,6 +856,16 @@ async function runSync(args: string[]): Promise<void> {
       continue;
     }
 
+    if (!dryRun && !existsSync(targetDir)) {
+      const approved = await confirmNewSyncTarget(targetName, targetDir, yes);
+      if (!approved) {
+        if (isInteractive()) {
+          console.log(`${targetName}: skipped — creating ${targetDir} was not approved`);
+        }
+        continue;
+      }
+    }
+
     const suffix = dryRun ? " (dry-run)" : "";
     const result = syncTarget(
       {
@@ -851,9 +888,24 @@ async function runSync(args: string[]): Promise<void> {
 
     if (target.project_groups.length > 0) {
       const allGroups = manifest.project ?? {};
-      const projectGroups = Object.fromEntries(
-        target.project_groups.map((name) => [name, allGroups[name]!]),
-      );
+      const projectGroups: Record<string, ProjectGroupInput> = {};
+      for (const groupName of target.project_groups) {
+        const group = allGroups[groupName]!;
+        const approvedPaths: string[] = [];
+        for (const path of group.paths) {
+          // Mirror syncProjectTargets' own `if (!existsSync(path)) continue` so we
+          // never prompt for a project path it would silently skip anyway.
+          if (!existsSync(path)) continue;
+          const pinDir = resolveProjectPinDir(targetDir, path);
+          if (dryRun || existsSync(pinDir)) {
+            approvedPaths.push(path);
+            continue;
+          }
+          const approved = await confirmNewSyncTarget(`${targetName}/${groupName}`, pinDir, yes);
+          if (approved) approvedPaths.push(path);
+        }
+        projectGroups[groupName] = { ...group, paths: approvedPaths };
+      }
       const projectResults = syncProjectTargets(
         { vaultPath, targetDir, targetName, projectGroups, localVaultPaths },
         { dryRun },
@@ -1437,7 +1489,12 @@ async function runInit(
   ) {
     console.log(`\n${printLastMile()}`);
   }
-  if (guided && sync && confirmedTargets.length > 0) await runSync([]);
+  // Reaching this point already required approval above (--yes, or an accepted
+  // confirmAction naming these exact targets/dirs) — that approval covers whatever
+  // new target directories this init just adopted, so runSync's own new-target
+  // confirmation gate would just be a redundant (and non-interactively,
+  // silently-skipping) re-ask.
+  if (guided && sync && confirmedTargets.length > 0) await runSync(["--yes"]);
 }
 
 function parseReportArgs(args: string[]): {
@@ -1563,15 +1620,18 @@ function parseInstallArgs(args: string[]): {
   force: boolean;
   dryRun: boolean;
   failOn?: ScanSeverity;
+  allowLocalSource: boolean;
 } {
   let repo: string | undefined;
   let force = false;
   let dryRun = false;
   let failOn: ScanSeverity | undefined;
+  let allowLocalSource = false;
   for (let i = 0; i < args.length; i++) {
     const option = args[i];
     if (option === "--force") force = true;
     else if (option === "--dry-run") dryRun = true;
+    else if (option === "--allow-local-source") allowLocalSource = true;
     else if (option === "--fail-on") {
       const value = args[++i];
       if (value !== "low" && value !== "medium" && value !== "high") {
@@ -1588,21 +1648,26 @@ function parseInstallArgs(args: string[]): {
       repo = option;
     }
   }
-  return { repo, force, dryRun, failOn };
+  return { repo, force, dryRun, failOn, allowLocalSource };
 }
 
 async function runInstall(
   args: string[],
   options: { isJson: boolean },
 ): Promise<void> {
-  const { repo, force, dryRun, failOn } = parseInstallArgs(args);
+  const { repo, force, dryRun, failOn, allowLocalSource } = parseInstallArgs(args);
   if (!repo) {
     throw new Error(
-      "usage: skillmux install <repo>[/path] [--force] [--fail-on low|medium|high] [--dry-run] [--json]",
+      "usage: skillmux install <repo>[/path] [--force] [--fail-on low|medium|high] [--dry-run] [--allow-local-source] [--json]",
     );
   }
 
   const source = resolveRepoSource(repo);
+  if (!allowLocalSource && isLocalFileUrl(source.url)) {
+    throw new Error(
+      `"${repo}" is a local (file://) source — pass --allow-local-source to install from it`,
+    );
+  }
   const cloneDir = await cloneToTemp(source.url);
   try {
     const resolved = resolveSkillDir(

package/src/commands/project.ts

@@ -397,7 +397,12 @@ export async function runProject(
   writeManifestAtomic(manifestPath, updated);
   if (request.sync) {
     try {
-      await options.sync([]);
+      // Reaching here already required approval above (request.yes, or an
+      // accepted interactive confirmAction) — that approval covers whatever
+      // new target/pin directories this project setup implies, so the
+      // downstream sync's own new-target confirmation gate would just be a
+      // redundant (and, non-interactively, silently-skipping) re-ask.
+      await options.sync(["--yes"]);
     } catch (error) {
       throw new Error(
         `project configuration was saved, but sync failed; fix the reported issue and run "skillmux sync": ${

package/src/commands/update.ts

@@ -14,6 +14,7 @@ import { emitSuccess } from "../output";
 import { hashSkillContent, readSkillOrigin, writeSkillOrigin } from "../provenance";
 import type { SkillOrigin } from "../provenance";
 import { type ScanFinding, type ScanSeverity, scanExitCode } from "../scan";
+import { SKILL_ID_PATTERN } from "../vault";
 import { confirmIfNeeded } from "./shared";
 import { checkOutdated } from "./outdated";
 
@@ -38,6 +39,16 @@ async function resolveCandidateOrigins(
   allowLocalSource: boolean,
 ): Promise<{ skillId: string; origin: SkillOrigin }[]> {
   if (skillId) {
+    // skillId (the CLI's positional <skill-id>) is joined straight into vaultPath
+    // below, and that join ultimately reaches installIntoVault's rmSync(recursive)
+    // + cpSync on the write path — a "../"-shaped value escapes the vault and lets
+    // `skillmux update` delete and overwrite an arbitrary directory on disk. Batch
+    // mode never hits this because checkOutdated only enumerates real vault entries
+    // (already SKILL_ID_PATTERN-filtered); the explicit single-skill path is the
+    // only one that takes this string directly from argv, so validate it here.
+    if (!SKILL_ID_PATTERN.test(skillId)) {
+      throw new Error(`invalid skill id "${skillId}": expected lowercase letters, digits, and hyphens only`);
+    }
     let origin: SkillOrigin | null;
     try {
       origin = readSkillOrigin(join(vaultPath, skillId));

package/src/config.ts

@@ -170,6 +170,18 @@ export function expandHome(path: string): string {
   return path.startsWith("~") ? join(homedir(), path.slice(1)) : path;
 }
 
+/**
+ * True only for hostnames the HTTP server can bind while staying unreachable
+ * from outside this machine. Deliberately narrower than adapters.ts's
+ * isLoopbackHost, which treats "0.0.0.0" as loopback for a different question
+ * (whether an admin *client* is talking to the local machine) — here "0.0.0.0"
+ * (and any other wildcard/public address) must read as non-loopback, since
+ * binding it is exactly what makes the server reachable from outside (SMX-91).
+ */
+export function isLoopbackBindHost(hostname: string): boolean {
+  return hostname === "localhost" || hostname === "::1" || hostname === "127.0.0.1" || hostname.startsWith("127.");
+}
+
 function isPlainObject(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/src/doctor.ts

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync } from "node:fs";
 import { createClients, RemoteInferenceError } from "./clients";
-import { embeddingDimension, expandHome } from "./config";
+import { embeddingDimension, expandHome, isLoopbackBindHost } from "./config";
 import { describeDeployment, type DeploymentIdentity } from "./deployment";
 import { parseManifest, resolveManifestPath, validateManifest } from "./manifest";
 import { readSkillmuxMarker } from "./sync";
@@ -51,6 +51,30 @@ export async function diagnose(
   }
   checks.push({ name: "vault", ok: existsSync(expandHome(config.vault_path)), detail: expandHome(config.vault_path) });
 
+  // SMX-91: `serve --transport http` itself refuses to start over this combination
+  // (assertSafeBindPosture in server.ts) unless SKILLMUX_ALLOW_INSECURE_BIND is set —
+  // surface it here too so it's visible without having to start the HTTP server first.
+  // An operator who has already set that env var has made an informed choice, so
+  // doctor treats it the same way the server does (ok, not a standing failure) —
+  // it doesn't re-litigate a decision the server itself already accepted.
+  if (config.server) {
+    const hostname = config.server.hostname ?? "127.0.0.1";
+    const insecureBindAcknowledged = environment.SKILLMUX_ALLOW_INSECURE_BIND === "true";
+    const bindIsSafe = isLoopbackBindHost(hostname) || config.server.auth_enabled || insecureBindAcknowledged;
+    checks.push({
+      name: "server_bind_posture",
+      ok: bindIsSafe,
+      detail: !bindIsSafe
+        ? `${hostname} is reachable beyond this machine with auth_enabled=false — ` +
+          "MCP tools and /stats would be open to anyone who can reach this port; " +
+          "set server.auth_enabled=true, bind a loopback hostname, or set SKILLMUX_ALLOW_INSECURE_BIND=true"
+        : insecureBindAcknowledged && !isLoopbackBindHost(hostname) && !config.server.auth_enabled
+          ? `${hostname}, auth_enabled=false, acknowledged via SKILLMUX_ALLOW_INSECURE_BIND`
+          : `${hostname}, auth_enabled=${config.server.auth_enabled}`,
+      failure_kind: bindIsSafe ? undefined : "configuration",
+    });
+  }
+
   for (const localPath of config.local_vault_paths) {
     const expanded = expandHome(localPath);
     checks.push({ name: `local_vault:${localPath}`, ok: existsSync(expanded), detail: expanded });

package/src/install.ts

@@ -13,7 +13,14 @@ const GIT_URL_PREFIXES = ["http://", "https://", "git://", "ssh://", "file://"];
 const SCP_LIKE_URL_PATTERN = /^[^/\s]+@[^/\s]+:/;
 
 export function isGitUrl(repo: string): boolean {
-  return GIT_URL_PREFIXES.some((prefix) => repo.startsWith(prefix)) || SCP_LIKE_URL_PATTERN.test(repo);
+  if (GIT_URL_PREFIXES.some((prefix) => repo.startsWith(prefix))) return true;
+  // scp-like syntax (user@host:path) has no URL scheme, so whatever accepts it here
+  // hands the raw string to `git clone`/`git ls-remote` as a bare positional argument.
+  // If that string starts with `-`, git's own option parser reads it as a flag, not a
+  // repository — verified against git 2.55: `--upload-pack=<cmd>@host:path` makes git
+  // run `<cmd>` as a real local shell command instead of contacting a remote. Reject
+  // it outright rather than let a crafted string reach that argv slot.
+  return SCP_LIKE_URL_PATTERN.test(repo) && !repo.startsWith("-");
 }
 
 /** A `file://` source_url reaches the local filesystem directly, not just a network
@@ -170,14 +177,32 @@ export interface ResolvedSkillDir {
   dir: string;
 }
 
+/** The returned skillId is joined straight into vaultPath by installIntoVault's callers
+ *  and fed to a real rmSync(recursive)+cpSync overwrite. Both branches below can produce
+ *  "." or ".." for a crafted-but-plausible input: `skill_path` of "." (e.g. `skillmux
+ *  install owner/repo/.`) survives the ".." segment check since "." isn't "..", and its
+ *  basename is "." too; `fallbackName` comes from deriveRepoName(url), which can return
+ *  ".." for a url whose last "/"- or ":"-delimited segment is literally "..". Verified
+ *  end-to-end against the real CLI binary: the former makes `install --force` wipe the
+ *  entire vault, the latter makes it wipe the vault's parent directory. Neither can ever
+ *  legitimately be a skill id, so reject both outright rather than let them reach a join. */
+function rejectTraversalSkillId(skillId: string): void {
+  if (skillId === "." || skillId === "..") {
+    throw new Error(`invalid skill id "${skillId}"`);
+  }
+}
+
 export function resolveSkillDir(cloneDir: string, fallbackName: string, skillPath?: string): ResolvedSkillDir {
   if (skillPath) {
     if (skillPath.startsWith("/") || skillPath.split("/").includes("..")) {
       throw new Error(`invalid skill_path "${skillPath}": must be a relative path within the repo`);
     }
-    return { skillId: basename(skillPath), dir: join(cloneDir, skillPath) };
+    const skillId = basename(skillPath);
+    rejectTraversalSkillId(skillId);
+    return { skillId, dir: join(cloneDir, skillPath) };
   }
   if (existsSync(join(cloneDir, "SKILL.md"))) {
+    rejectTraversalSkillId(fallbackName);
     return { skillId: fallbackName, dir: cloneDir };
   }
   const discovered = readdirSync(cloneDir, { withFileTypes: true })

package/src/rate-limiter.ts

@@ -3,6 +3,14 @@ interface Bucket {
   lastRefillMs: number;
 }
 
+// SMX-93: bounds memory even when an attacker (behind a trust_proxy-honored
+// reverse proxy) mints unbounded distinct X-Forwarded-For values, or a
+// long-running deployment simply accumulates many distinct legitimate
+// clients over time. Past this many entries, the least-recently-used
+// bucket is evicted to make room — active clients are never evicted ahead
+// of idle ones.
+const DEFAULT_MAX_BUCKETS = 10_000;
+
 export interface RateLimitCheckInput {
   nowMs: number;
   auth_enabled: boolean;
@@ -22,12 +30,19 @@ export class RateLimiter {
   private enabled: boolean;
   private requests_per_minute: number;
   private trust_proxy: boolean;
+  private max_buckets: number;
   private buckets = new Map<string, Bucket>();
 
-  constructor(config: { enabled: boolean; requests_per_minute: number; trust_proxy?: boolean }) {
+  constructor(config: {
+    enabled: boolean;
+    requests_per_minute: number;
+    trust_proxy?: boolean;
+    max_buckets?: number;
+  }) {
     this.enabled = config.enabled;
     this.requests_per_minute = config.requests_per_minute;
     this.trust_proxy = config.trust_proxy ?? false;
+    this.max_buckets = config.max_buckets ?? DEFAULT_MAX_BUCKETS;
   }
 
   check(input: RateLimitCheckInput): RateLimitCheckResult {
@@ -59,7 +74,19 @@ export class RateLimiter {
 
     // 2. Retrieve or initialize bucket
     let bucket = this.buckets.get(id);
-    if (!bucket) {
+    if (bucket) {
+      // Map iteration order is insertion order, so re-inserting on touch
+      // marks this entry as most-recently-used and moves it out of the
+      // eviction path below.
+      this.buckets.delete(id);
+      this.buckets.set(id, bucket);
+    } else {
+      if (this.buckets.size >= this.max_buckets) {
+        const oldestId = this.buckets.keys().next().value;
+        if (oldestId !== undefined) {
+          this.buckets.delete(oldestId);
+        }
+      }
       bucket = {
         tokens: this.requests_per_minute,
         lastRefillMs: input.nowMs,

package/src/server.ts

@@ -1,10 +1,10 @@
 #!/usr/bin/env bun
-import { timingSafeEqual } from "node:crypto";
+import { createHash, timingSafeEqual } from "node:crypto";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { createClients } from "./clients";
-import { loadConfig, resolveConfigPath } from "./config";
+import { isLoopbackBindHost, loadConfig, resolveConfigPath } from "./config";
 import { describeDeployment } from "./deployment";
 import { ConfigWatcher, type ReloadStatus } from "./config-watcher";
 import { RuntimeSnapshotManager } from "./snapshot";
@@ -40,6 +40,35 @@ export interface ServerHandle {
   stop(): Promise<void>;
 }
 
+/**
+ * Docker's documented deployment mode auto-switches hostname to "0.0.0.0"
+ * (config.ts's RUNNING_IN_DOCKER override) while server.auth_enabled still
+ * defaults to false and allowed_origins defaults to [] — which only blocks
+ * requests that carry an Origin header, so a plain server-to-server/curl
+ * request sails through unauthenticated. That default combination leaves MCP
+ * tools (resolve_skill/fetch_skill) and /stats (raw historical query text)
+ * open to anyone who can reach the port — the documented common case, not an
+ * edge case (SMX-91). Refuse to start rather than silently exposing it;
+ * SKILLMUX_ALLOW_INSECURE_BIND is the explicit, logged escape hatch for
+ * operators who rely on network-level isolation instead of application auth.
+ */
+export function assertSafeBindPosture(
+  hostname: string,
+  authEnabled: boolean,
+  env: Record<string, string | undefined> = process.env,
+): void {
+  if (isLoopbackBindHost(hostname) || authEnabled) return;
+  const message =
+    `refusing to bind "${hostname}" (reachable beyond this machine) with server.auth_enabled=false — ` +
+    "MCP tools (resolve_skill/fetch_skill) and /stats would be open to anyone who can reach this port. " +
+    "Set server.auth_enabled=true (with SKILLMUX_AUTH_TOKEN) or bind a loopback hostname instead. " +
+    "To start anyway — e.g. when network isolation is the intended boundary — set SKILLMUX_ALLOW_INSECURE_BIND=true.";
+  if (env.SKILLMUX_ALLOW_INSECURE_BIND !== "true") {
+    throw new Error(`skillmux: ${message}`);
+  }
+  console.error(`skillmux: WARNING — ${message}`);
+}
+
 let warnedAuthToken = false;
 function resolveAuthToken(envName: string): string {
   const value = process.env[envName];
@@ -59,11 +88,14 @@ function resolveAuthToken(envName: string): string {
   return "";
 }
 
-function safeTokenEquals(a: string, b: string): boolean {
-  const bufA = Buffer.from(a);
-  const bufB = Buffer.from(b);
-  if (bufA.length !== bufB.length) return false;
-  return timingSafeEqual(bufA, bufB);
+// SMX-94: comparing raw buffers made length itself observable — a
+// mismatched-length pair returns before ever reaching timingSafeEqual.
+// Hashing both sides to a fixed 32-byte digest first means every
+// comparison takes the same constant-time path regardless of input length.
+export function safeTokenEquals(a: string, b: string): boolean {
+  const hashA = createHash("sha256").update(a).digest();
+  const hashB = createHash("sha256").update(b).digest();
+  return timingSafeEqual(hashA, hashB);
 }
 
 export function createMcpServer(): McpServer {
@@ -206,6 +238,7 @@ export async function startServer(opts?: {
 
     const port = opts?.port ?? Number(process.env.PORT || 3000);
     const hostname = config.server?.hostname ?? "127.0.0.1";
+    assertSafeBindPosture(hostname, config.server?.auth_enabled ?? false);
     const bunServer = Bun.serve({
       port,
       hostname,