@loicngr/kobo 2.1.26 → 2.1.28

package/dist/server/services/internal-mcp-capability-service.js

@@ -0,0 +1,98 @@
+import { randomBytes } from 'node:crypto';
+import { isProgressBarTool } from '../../shared/progress-bar-tools.js';
+import { WORKSPACE_CREATION_TOOLS } from '../../shared/workspace-creation-tools.js';
+import { EXTERNAL_MCP_TOOLS } from '../../shared/workspace-dialogue-tools.js';
+import { WORKSPACE_GROUP_MESSAGE_TOOLS } from '../../shared/workspace-group-message-tools.js';
+import { WORKSPACE_LIFECYCLE_TOOLS } from '../../shared/workspace-lifecycle-tools.js';
+const capabilities = new Map();
+const readTools = new Set([
+    'list_tasks',
+    'get_settings',
+    'get_dev_server_status',
+    'get_workspace_info',
+    'cron_list',
+    'get_dev_server_logs',
+    'list_workspace_images',
+    'get_ticket',
+    'get_notion_ticket',
+    'get_git_info',
+    'list_documents',
+    'read_document',
+    'get_session_usage',
+    'read_workspace_events_csv',
+    'search_codebase',
+    'list_workspaces',
+    'list_memory_scopes',
+    'list_memories',
+    'read_memory',
+    'search_memories',
+    'list_memory_operations',
+    ...EXTERNAL_MCP_TOOLS.filter((t) => t.annotations?.readOnlyHint).map((t) => t.name),
+    ...WORKSPACE_GROUP_MESSAGE_TOOLS.filter((t) => t.annotations?.readOnlyHint).map((t) => t.name),
+    ...WORKSPACE_CREATION_TOOLS.filter((t) => t.annotations?.readOnlyHint).map((t) => t.name),
+]);
+const writeTools = new Set([
+    'mark_task_done',
+    'mark_auto_loop_ready',
+    'create_task',
+    'update_task',
+    'delete_task',
+    'set_auto_loop',
+    'set_workspace_agent_description',
+    'set_workspace_name',
+    'cron_create',
+    'cron_delete',
+    'start_dev_server',
+    'stop_dev_server',
+    'set_workspace_status',
+    'log_thought',
+    'schedule_wakeup',
+    'cancel_wakeup',
+    'stop_workspace',
+    'remember',
+    ...EXTERNAL_MCP_TOOLS.map((t) => t.name),
+    ...WORKSPACE_CREATION_TOOLS.map((t) => t.name),
+    ...WORKSPACE_LIFECYCLE_TOOLS.map((t) => t.name),
+    ...WORKSPACE_GROUP_MESSAGE_TOOLS.map((t) => t.name),
+]);
+const externalTools = new Set([
+    ...EXTERNAL_MCP_TOOLS.map((t) => t.name),
+    ...WORKSPACE_CREATION_TOOLS.map((t) => t.name),
+    ...WORKSPACE_LIFECYCLE_TOOLS.map((t) => t.name),
+    ...WORKSPACE_GROUP_MESSAGE_TOOLS.map((t) => t.name),
+    'stop_workspace',
+]);
+export function createInternalMcpCapability(input) {
+    const capability = { ...input, env: { ...input.env }, token: randomBytes(32).toString('base64url') };
+    capabilities.set(capability.token, capability);
+    return capability;
+}
+export function revokeInternalMcpCapability(token) {
+    capabilities.delete(token);
+}
+export function resolveInternalMcpCapability(token) {
+    const capability = token ? capabilities.get(token) : undefined;
+    if (!capability)
+        throw new Error('Invalid or revoked managed MCP capability');
+    return capability;
+}
+export function authorizeInternalMcpTool(token, name, args) {
+    const capability = resolveInternalMcpCapability(token);
+    const report = (name === 'submit_final_review' &&
+        capability.env.KOBO_FINAL_REVIEW_TOKEN &&
+        capability.env.KOBO_FINAL_REVIEW_SESSION_ID === capability.sessionId) ||
+        (name === 'submit_session_handoff' && capability.env.KOBO_HANDOFF_TOKEN && capability.env.KOBO_HANDOFF_ID);
+    const progress = isProgressBarTool(name) && capability.env.KOBO_PROGRESS_SESSION_TOKEN;
+    if (!report && !progress && !readTools.has(name) && !writeTools.has(name))
+        throw new Error(`Unknown or unavailable tool: ${name}`);
+    if (capability.readOnly && !readTools.has(name) && !report && !progress)
+        throw new Error('This managed MCP launch is read-only');
+    if (!externalTools.has(name) && args.workspace_id !== undefined && args.workspace_id !== capability.workspaceId)
+        throw new Error('Tool is bound to its launch workspace');
+    if ((name === 'send_workspace_message' && args.workspace_id === capability.workspaceId) ||
+        (name === 'send_workspace_group_message' &&
+            Array.isArray(args.workspace_ids) &&
+            args.workspace_ids.includes(capability.workspaceId)))
+        throw new Error('Use the normal conversation in your own workspace');
+    return capability;
+}

package/dist/server/services/mcp-connection-info-service.js

@@ -29,7 +29,7 @@ export function buildMcpConnectionInfo(input) {
         networkEnabled: input.networkEnabled,
         behindProxy: input.behindProxy,
         proxyHostname: input.proxyHostname,
-        localRequiresToken: input.behindProxy,
+        localRequiresToken: true,
         stdio: args
             ? {
                 command: input.command,

package/dist/server/services/memory-mcp-service.js

@@ -2,7 +2,7 @@ import { deriveMemoryActor } from '../../shared/memory.js';
 import { isMemoryToolName, validateMemoryToolArguments } from '../../shared/memory-tools.js';
 import { prepareMemoryControlReply, prepareMemoryToolEnvelope, sliceMemoryBodyFragment, } from '../utils/memory-token-budget.js';
 import { createExternalMemoryBudgetContext, reserveMemoryBudget, reserveMemoryBudgetDenial, wasMemoryFragmentDelivered, } from './memory-budget-service.js';
-import { listMemories, listMemoryOperations, listMemoryScopes, listWorkspaceMemoryOperations, readMemory, remember, searchMemories, } from './memory-service.js';
+import { listMemories, listMemoryOperations, listMemoryScopes, listWorkspaceMemoryOperations, listWorkspaceMemoryScopes, readMemory, remember, searchMemories, } from './memory-service.js';
 function externalActor(source) {
     if (source.kind !== 'mcp')
         throw new TypeError('External memory tools require MCP client context');
@@ -176,7 +176,7 @@ function chargeExternalOutput(input) {
     return addBudgetReceipt(sized.data, input.contextId, reservation.estimatedTokens, reservation.remainingTokens);
 }
 /** Execute the external memory surface; caller identity is always derived from MCP transport. */
-export function executeMemoryMcpTool(name, input, source) {
+export function executeMemoryMcpTool(name, input, source, allowedWorkspaceIds) {
     if (!isMemoryToolName(name))
         throw new TypeError(`Unknown memory tool '${name}'`);
     const actor = externalActor(source);
@@ -212,11 +212,13 @@ export function executeMemoryMcpTool(name, input, source) {
     try {
         switch (name) {
             case 'list_memory_scopes':
-                data = boundedScopes(listMemoryScopes({
-                    ...(args.workspace_id ? { workspaceId: args.workspace_id } : {}),
-                    ...(cursor ? { cursor } : {}),
-                    ...(limit ? { limit } : {}),
-                }));
+                data = boundedScopes(allowedWorkspaceIds
+                    ? listWorkspaceMemoryScopes(args.workspace_id ? allowedWorkspaceIds.filter((id) => id === args.workspace_id) : allowedWorkspaceIds, { ...(cursor ? { cursor } : {}), ...(limit ? { limit } : {}) })
+                    : listMemoryScopes({
+                        ...(args.workspace_id ? { workspaceId: args.workspace_id } : {}),
+                        ...(cursor ? { cursor } : {}),
+                        ...(limit ? { limit } : {}),
+                    }));
                 break;
             case 'list_memories': {
                 const page = listMemories({ ...selection, actor, ...(cursor ? { cursor } : {}), ...(limit ? { limit } : {}) });

package/dist/server/services/memory-service.js

@@ -210,6 +210,21 @@ export function resolveMemoryScope(input) {
     }
     return materializeScope(input);
 }
+/** Resolve only the workspace-owned scope, without creating or exposing ancestors. */
+export function resolveWorkspaceMemoryScope(workspaceId) {
+    return materializeScope({ level: 'workspace', workspaceId });
+}
+/** Catalogue for a caller whose authority is explicitly restricted to these workspaces. */
+export function listWorkspaceMemoryScopes(workspaceIds, options = {}) {
+    const limit = requireBoundedPage(options.limit);
+    const offset = requireCursor(options.cursor);
+    const exists = getDb().prepare('SELECT id FROM workspaces WHERE id = ?');
+    const existing = [...new Set(workspaceIds)].sort().filter((id) => exists.get(id));
+    return {
+        items: existing.slice(offset, offset + limit).map(resolveWorkspaceMemoryScope),
+        ...(offset + limit < existing.length ? { nextCursor: String(offset + limit) } : {}),
+    };
+}
 /** Lists persisted scopes; a workspace view always includes the exact applicable ancestors. */
 export function listMemoryScopes(options = {}) {
     const limit = requireBoundedPage(options.limit);

package/dist/server/services/network-access-service.js

@@ -64,18 +64,29 @@ const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '::ffff:127.0.
  * scheme (`http://127.0.0.1:3000`); adding a scheme when none is present runs
  * both through the same URL rules, including the bracketed IPv6 form.
  */
-function headerHostname(value) {
+function parseOrigin(value) {
+    if (!/^https?:\/\/[^/?#\\\s]+$/i.test(value))
+        return null;
     try {
-        const hostname = new URL(value.includes('://') ? value : `http://${value}`).hostname;
-        if (!hostname)
-            return null;
-        // The URL parser keeps IPv6 hostnames bracketed; compare on the bare address.
-        return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+        const url = new URL(value);
+        return url.hostname && !url.username && !url.password ? url : null;
     }
     catch {
         return null;
     }
 }
+function parseHost(value) {
+    if (!value || /[/?#@\\\s]/.test(value))
+        return null;
+    return parseOrigin(`http://${value}`);
+}
+function headerHostname(value) {
+    const url = value.includes('://') ? parseOrigin(value) : parseHost(value);
+    const hostname = url?.hostname;
+    if (!hostname)
+        return null;
+    return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+}
 /**
  * True when a raw `Host`/`Origin` value names the machine itself. Always
  * allowed, whatever the settings say, which lets a caller settle the common
@@ -83,7 +94,7 @@ function headerHostname(value) {
  * both synchronous, and this runs on every request.
  */
 export function isLocalRequestHost(value) {
-    if (!value)
+    if (!value || !parseHost(value))
         return false;
     const hostname = headerHostname(value);
     return hostname !== null && LOCAL_HOSTNAMES.has(hostname);
@@ -95,52 +106,35 @@ function isAllowedHostname(hostname, enabled, lanHostnames) {
         return true;
     return enabled && lanHostnames.includes(hostname);
 }
-/**
- * Guards against DNS rebinding: a page on `evil.com` whose domain re-resolves
- * to 127.0.0.1 reaches this server with `Host: evil.com`, and the browser then
- * treats every response as same-origin. Only the names by which the machine is
- * legitimately reachable are accepted — its own loopback names, plus its LAN
- * addresses once network access is enabled.
- *
- * Behind a reverse proxy the Host is whatever domain the operator chose. When
- * they declare it via `KOBO_NETWORK_ACCESS_PROXY_HOST` it is enforced like any
- * other name; without it we cannot tell their domain from an attacker's, so
- * anything is accepted. That mode also turns off the loopback exemption, so
- * every `/api/*` request has to carry the token.
- *
- * Residual risk when the hostname is left undeclared: the SPA shell is served
- * outside `/api/*` and therefore behind no token, so a rebinding page can be
- * handed the real interface and ask the user to paste their token into it.
- * Declaring the hostname closes that; otherwise, authenticate at the proxy.
- */
+/** Reject malformed/rebinding hosts. Proxy mode requires a declared public host;
+ * loopback remains reachable for authenticated internal clients and health checks. */
 export function isAllowedRequestHost(params) {
     if (!params.host)
         return false;
-    const hostname = headerHostname(params.host);
+    const hostname = parseHost(params.host) ? headerHostname(params.host) : null;
     if (params.behindProxy) {
-        // No declared hostname means we cannot tell the operator's domain from an
-        // attacker's, so anything goes — the historical behaviour.
+        if (!hostname)
+            return false;
         if (!params.proxyHostname)
-            return true;
+            return LOCAL_HOSTNAMES.has(hostname);
         return hostname === params.proxyHostname || (hostname !== null && LOCAL_HOSTNAMES.has(hostname));
     }
     return isAllowedHostname(hostname, params.enabled, params.lanHostnames);
 }
-/**
- * Hostname declared via `KOBO_NETWORK_ACCESS_PROXY_HOST`, or null when unset.
- *
- * Behind a reverse proxy we otherwise have to accept any Host, which leaves the
- * door open to a rebinding page being served the real interface and asking the
- * user to paste their token into it. Declaring the domain the proxy serves
- * closes that, and costs one environment variable in the compose file where
- * the other network-access settings already live.
- */
+/** Validated hostname declared by the operator; invalid/missing values fail closed. */
 export function resolveProxyHostname(env = process.env) {
     const raw = env.KOBO_NETWORK_ACCESS_PROXY_HOST?.trim();
     if (!raw)
         return null;
     return headerHostname(raw);
 }
+/** Exact public origin. A bare configured hostname implies HTTPS. */
+export function resolveProxyOrigin(env = process.env) {
+    const raw = env.KOBO_NETWORK_ACCESS_PROXY_HOST?.trim();
+    if (!raw)
+        return null;
+    return parseOrigin(raw.includes('://') ? raw : `https://${raw}`)?.origin ?? null;
+}
 /**
  * Names the site a request was driven from. Guards two things.
  *
@@ -173,29 +167,22 @@ export function resolveProxyHostname(env = process.env) {
 export function isAllowedOrigin(params) {
     if (params.origin === undefined)
         return true;
-    const origin = authority(params.origin);
-    if (origin === null)
+    const origin = parseOrigin(params.origin)?.origin;
+    if (!origin)
         return false;
     if (params.behindProxy) {
         if (!params.proxyHostname)
-            return true;
-        return headerHostname(params.origin) === params.proxyHostname;
+            return false;
+        const expected = params.proxyOrigin ?? parseOrigin(`https://${params.proxyHostname}`)?.origin;
+        return origin === expected;
     }
-    // `quasar dev` proxies to the backend with changeOrigin, so it rewrites the
-    // Host to ours while the browser stays on the Quasar port. The two cannot
-    // match there, hence the explicit declaration.
-    if (params.devOrigin && origin === authority(params.devOrigin))
+    // The explicit Quasar development origin can differ from the backend port.
+    if (params.devOrigin && origin === parseOrigin(params.devOrigin)?.origin)
         return true;
-    return params.requestHost !== undefined && origin === authority(params.requestHost);
-}
-/** Host and port of a raw `Host`/`Origin` value, or null when unparseable. */
-function authority(value) {
-    try {
-        return new URL(value.includes('://') ? value : `http://${value}`).host || null;
-    }
-    catch {
-        return null;
-    }
+    if (!params.requestHost || !parseHost(params.requestHost))
+        return false;
+    const protocol = params.requestProtocol ?? 'http:';
+    return origin === parseOrigin(`${protocol}//${params.requestHost}`)?.origin;
 }
 /**
  * Origin the development client is served from, declared by the `dev` script
@@ -231,23 +218,6 @@ export function evaluateNetworkAccess(params) {
         return { allow: true, status: 200 };
     return { allow: false, status: 401 };
 }
-/** WS upgrade authorization: parses `?token=` from the raw URL. */
-export function authorizeWsUpgrade(params) {
-    let providedToken;
-    try {
-        providedToken = new URL(params.rawUrl ?? '/', 'http://localhost').searchParams.get('token') ?? undefined;
-    }
-    catch {
-        providedToken = undefined;
-    }
-    return evaluateNetworkAccess({
-        address: params.address,
-        enabled: params.enabled,
-        expectedToken: params.expectedToken,
-        providedToken,
-        trustLoopback: params.trustLoopback,
-    }).allow;
-}
 /**
  * Reads KOBO_NETWORK_ACCESS_ENABLED / KOBO_NETWORK_ACCESS_BEHIND_PROXY and
  * returns only the fields an env var actually specifies — an unset env var

package/dist/server/services/network-session-service.js

@@ -0,0 +1,182 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { isLoopbackAddress, resolveProxyOrigin } from './network-access-service.js';
+const sessions = new Map();
+const tickets = new Map();
+const sockets = new Map();
+const revokedSockets = new WeakSet();
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+const fingerprint = (p) => hash(JSON.stringify([p.networkAccessEnabled, !!p.networkAccessBehindProxy, p.networkAccessToken]));
+const lifetime = 12 * 60 * 60 * 1000;
+export function isNetworkTransportAllowed(address, policy) {
+    return policy.networkAccessEnabled || (!policy.networkAccessBehindProxy && isLoopbackAddress(address));
+}
+function prune() {
+    const now = Date.now();
+    for (const [id, session] of sessions)
+        if (session.expiresAt <= now)
+            sessions.delete(id);
+    for (const [id, ticket] of tickets)
+        if (ticket.expiresAt <= now)
+            tickets.delete(id);
+}
+export function createBrowserSession(policy) {
+    prune();
+    if (sessions.size >= 256)
+        throw new Error('Session capacity reached');
+    const session = {
+        token: randomBytes(32).toString('base64url'),
+        expiresAt: Date.now() + lifetime,
+        policy: fingerprint(policy),
+    };
+    const { token, ...record } = session;
+    sessions.set(hash(token), record);
+    return session;
+}
+export function getBrowserSession(token, policy) {
+    if (!token || token.length > 128)
+        return undefined;
+    const record = sessions.get(hash(token));
+    if (!record || record.expiresAt <= Date.now() || record.policy !== fingerprint(policy))
+        return undefined;
+    return { ...record, token };
+}
+function sessionValid(session, policy) {
+    return !session || !!getBrowserSession(session.token, policy);
+}
+export function createWebSocketTicket(path, policy, session) {
+    if (!/^\/ws(?:\/terminal\/[A-Za-z0-9_-]{1,200})?$/.test(path))
+        throw new Error('Invalid WebSocket path');
+    prune();
+    if (tickets.size >= 1024)
+        throw new Error('Ticket capacity reached');
+    if (!sessionValid(session, policy))
+        throw new Error('Session expired');
+    const token = randomBytes(32).toString('base64url');
+    tickets.set(hash(token), { path, policy: fingerprint(policy), expiresAt: Date.now() + 60_000, session });
+    return token;
+}
+export function consumeWebSocketTicket(token, path, policy) {
+    if (!token || token.length > 128)
+        return undefined;
+    const id = hash(token);
+    const ticket = tickets.get(id);
+    tickets.delete(id);
+    if (!ticket ||
+        ticket.path !== path ||
+        ticket.expiresAt <= Date.now() ||
+        ticket.policy !== fingerprint(policy) ||
+        !sessionValid(ticket.session, policy))
+        return undefined;
+    return ticket;
+}
+function terminate(ws) {
+    const grant = sockets.get(ws);
+    if (grant) {
+        grant.revoked = true;
+        clearTimeout(grant.timer);
+        sockets.delete(ws);
+    }
+    if (!revokedSockets.has(ws)) {
+        revokedSockets.add(ws);
+        ws.terminate();
+    }
+}
+export function registerNetworkSocket(ws, address, policy, current, session) {
+    let currentPolicy;
+    try {
+        currentPolicy = current();
+    }
+    catch {
+        terminate(ws);
+        return false;
+    }
+    if (!isNetworkTransportAllowed(address, currentPolicy) ||
+        sockets.size >= 256 ||
+        [...sockets.values()].filter((g) => g.address === address).length >= 64 ||
+        !sessionValid(session, currentPolicy) ||
+        fingerprint(policy) !== fingerprint(currentPolicy)) {
+        terminate(ws);
+        return false;
+    }
+    const expiresAt = session?.expiresAt ?? Date.now() + lifetime;
+    const timer = setTimeout(() => terminate(ws), Math.max(0, expiresAt - Date.now()));
+    timer.unref?.();
+    sockets.set(ws, {
+        address,
+        policy: fingerprint(policy),
+        current,
+        session,
+        expiresAt,
+        revoked: false,
+        timer,
+        count: 0,
+        window: Date.now(),
+    });
+    ws.once('close', () => {
+        clearTimeout(timer);
+        sockets.delete(ws);
+        revokedSockets.add(ws);
+    });
+    return true;
+}
+export function isNetworkSocketAuthorized(ws) {
+    if (revokedSockets.has(ws))
+        return false;
+    const grant = sockets.get(ws);
+    if (!grant)
+        return true; // Unregistered service-level sockets do not participate in network authentication.
+    let policy;
+    try {
+        policy = grant.current();
+    }
+    catch {
+        terminate(ws);
+        return false;
+    }
+    if (grant.revoked ||
+        grant.expiresAt <= Date.now() ||
+        !isNetworkTransportAllowed(grant.address, policy) ||
+        grant.policy !== fingerprint(policy) ||
+        !sessionValid(grant.session, policy)) {
+        terminate(ws);
+        return false;
+    }
+    return true;
+}
+export function acceptNetworkSocketMessage(ws) {
+    if (!isNetworkSocketAuthorized(ws))
+        return false;
+    const grant = sockets.get(ws);
+    if (!grant)
+        return true;
+    if (Date.now() - grant.window >= 1000) {
+        grant.window = Date.now();
+        grant.count = 0;
+    }
+    if (++grant.count > 240) {
+        terminate(ws);
+        return false;
+    }
+    return true;
+}
+export function revokeBrowserSession(token) {
+    sessions.delete(hash(token));
+    for (const [id, ticket] of tickets)
+        if (ticket.session?.token === token)
+            tickets.delete(id);
+    for (const [ws, grant] of sockets)
+        if (grant.session?.token === token)
+            terminate(ws);
+}
+export function revokeNetworkSessions() {
+    sessions.clear();
+    tickets.clear();
+    for (const ws of sockets.keys())
+        terminate(ws);
+}
+export function browserCookieName(policy) {
+    return secureBrowserCookie(policy) ? '__Host-kobo-session' : 'kobo-session';
+}
+export function secureBrowserCookie(policy) {
+    return !!policy.networkAccessBehindProxy && !resolveProxyOrigin()?.startsWith('http:');
+}

package/dist/server/services/settings-service.js

@@ -12,6 +12,7 @@ import { getSettingsPath } from '../utils/paths.js';
 import { InvalidWorktreesPathError, resolveGlobalWorktreesRoot, sanitizeWorktreesPath, validateWorktreesPath, } from '../utils/worktree-paths.js';
 import { DEFAULT_NOTION_INITIAL_PROMPT, DEFAULT_SENTRY_INITIAL_PROMPT } from './initial-prompt-template-service.js';
 import { LEGACY_AGNOSTIC_AUTO_LOOP_REVIEW_GATE, LEGACY_AGNOSTIC_REVIEW_TEMPLATE, LEGACY_CI_FIX_PROMPT_TEMPLATE, LEGACY_FINALIZATION_PROMPT, LEGACY_NOTION_INITIAL_PROMPT, LEGACY_PR_PROMPT_TEMPLATE, LEGACY_SENTRY_INITIAL_PROMPT, } from './legacy-public-prompts.js';
+import { revokeNetworkSessions } from './network-session-service.js';
 import { DEFAULT_REVIEW_PROMPT_TEMPLATE } from './review-template-service.js';
 import { DEFAULT_CHANGE_SOURCE_BRANCH_SCRIPT, DEFAULT_MODEL_BY_ENGINE, FRESH_MODEL_BY_ENGINE, } from './settings-defaults.js';
 import { AGNOSTIC_PROMPTS } from './skill-suite-prompts.js';
@@ -1293,6 +1294,7 @@ function readSettings() {
 }
 function readSettingsFromDisk() {
     ensureSettingsPathInitialized();
+    protectSettingsFiles();
     if (!fs.existsSync(settingsFilePath)) {
         const defaults = defaultSettings();
         writeSettings(defaults);
@@ -1334,6 +1336,22 @@ function readSettingsFromDisk() {
 }
 /** Number of `settings.json.backup-*` files kept; older ones are rotated out. */
 const SETTINGS_BACKUP_KEEP = 5;
+/** Repair legacy permissions before reading secrets, without following file symlinks. */
+function protectSettingsFiles() {
+    const dir = path.dirname(settingsFilePath);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.chmodSync(dir, 0o700);
+    const basename = path.basename(settingsFilePath);
+    for (const name of fs.readdirSync(dir)) {
+        if (name !== basename && name !== `${basename}.tmp` && !name.startsWith(`${basename}.backup-`))
+            continue;
+        const file = path.join(dir, name);
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.nlink !== 1)
+            throw new Error('[settings] Refusing unsafe settings file');
+        fs.chmodSync(file, 0o600);
+    }
+}
 /**
  * Keep only the `SETTINGS_BACKUP_KEEP` most recent `settings.json.backup-*`
  * files in `dir`, deleting the rest. Best-effort — never throws.
@@ -1368,7 +1386,7 @@ function createSettingsBackupIfPresent() {
     const stamp = new Date().toISOString().replace(/[:.]/g, '-');
     settingsBackupSequence += 1;
     const backupPath = path.join(dir, `settings.json.backup-${stamp}-${settingsBackupSequence}`);
-    fs.copyFileSync(settingsFilePath, backupPath);
+    fs.writeFileSync(backupPath, fs.readFileSync(settingsFilePath), { mode: 0o600, flag: 'wx' });
     pruneSettingsBackups(dir);
 }
 function writeSettings(settings, options) {
@@ -1376,14 +1394,11 @@ function writeSettings(settings, options) {
     invalidateSettingsCache();
     ensureSettingsPathInitialized();
     const tmpPath = `${settingsFilePath}.tmp`;
-    const dir = path.dirname(settingsFilePath);
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true });
-    }
+    protectSettingsFiles();
     if (options?.backup) {
         createSettingsBackupIfPresent();
     }
-    fs.writeFileSync(tmpPath, JSON.stringify(settings, null, 2), 'utf-8');
+    fs.writeFileSync(tmpPath, JSON.stringify(settings, null, 2), { encoding: 'utf-8', mode: 0o600 });
     fs.renameSync(tmpPath, settingsFilePath);
 }
 /** Read and return the full settings object, creating defaults if missing. */
@@ -1823,7 +1838,9 @@ export function updateGlobalSettings(input) {
  * (which would leave the server bound wide but unauthenticatable after a restart).
  */
 export function updateNetworkAccessSettings(patch) {
-    const settings = readSettings();
+    const current = readSettings();
+    // Keep cached policy intact until persistence succeeds.
+    const settings = { ...current, global: { ...current.global } };
     if (typeof patch.networkAccessEnabled === 'boolean') {
         settings.global.networkAccessEnabled = patch.networkAccessEnabled;
     }
@@ -1834,6 +1851,11 @@ export function updateNetworkAccessSettings(patch) {
         settings.global.networkAccessBehindProxy = patch.networkAccessBehindProxy;
     }
     writeSettings(settings, { backup: true });
+    if (current.global.networkAccessEnabled !== settings.global.networkAccessEnabled ||
+        current.global.networkAccessToken !== settings.global.networkAccessToken ||
+        current.global.networkAccessBehindProxy !== settings.global.networkAccessBehindProxy) {
+        revokeNetworkSessions();
+    }
     return settings.global;
 }
 function ensureGlobalWorktreesRootExists(worktreesPath) {

package/dist/server/services/terminal-websocket-service.js

@@ -1,4 +1,5 @@
 import { assertWorkspaceLifecycleAvailable, isWorkspaceLifecycleBusy } from '../utils/workspace-lifecycle-guard.js';
+import { acceptNetworkSocketMessage, isNetworkSocketAuthorized } from './network-session-service.js';
 import { createTerminal, getTerminal } from './terminal-service.js';
 import { getWorkspace } from './workspace-service.js';
 const MAX_BUFFERED_BYTES = 1024 * 1024;
@@ -31,6 +32,8 @@ export function handleTerminalConnection(ws, workspaceId, isShuttingDown = () =>
         ws.terminate();
     }
     function send(data) {
+        if (!isNetworkSocketAuthorized(ws))
+            return false;
         if (disposed || ws.readyState !== 1)
             return false;
         if (ws.bufferedAmount + Buffer.byteLength(data) > MAX_BUFFERED_BYTES) {
@@ -72,6 +75,8 @@ export function handleTerminalConnection(ws, workspaceId, isShuttingDown = () =>
     ws.on('close', dispose);
     ws.on('error', disconnect);
     ws.on('message', (data, isBinary) => {
+        if (!acceptNetworkSocketMessage(ws))
+            return;
         if (disposed || ws.readyState !== 1 || isShuttingDown())
             return;
         if (isBinary) {

package/dist/server/services/websocket-service.js

@@ -1,6 +1,7 @@
 import { nanoid } from 'nanoid';
 import { getDb } from '../db/index.js';
 import { recordActivity } from './activity-service.js';
+import { acceptNetworkSocketMessage, isNetworkSocketAuthorized } from './network-session-service.js';
 import { getAllPersistedSnapshots } from './usage/db.js';
 // ── State ──────────────────────────────────────────────────────────────────────
 /** Maps each WS client to the set of workspaceIds they are subscribed to */
@@ -11,6 +12,8 @@ const clients = new Map();
 const MAX_BUFFERED_BYTES = 1024 * 1024;
 /** A dropped frame must end the connection so its replay cursor cannot skip it. */
 function sendFrame(ws, message) {
+    if (!isNetworkSocketAuthorized(ws))
+        return;
     if (ws.readyState !== 1)
         return;
     if (ws.bufferedAmount > MAX_BUFFERED_BYTES) {
@@ -92,6 +95,8 @@ export function handleConnection(ws) {
         console.error('[ws] usage hydration failed:', err);
     }
     ws.on('message', (data) => {
+        if (!acceptNetworkSocketMessage(ws))
+            return;
         let msg;
         try {
             const parsed = JSON.parse(data.toString());