@nxuss/lemma 0.8.0 → 0.8.1

package/README.md

@@ -1,4 +1,4 @@
-# 🧠 Lemma v0.8.0
+# 🧠 Lemma v0.8.1
 
 [![npm version](https://img.shields.io/npm/v/@nxuss/lemma.svg?color=orange&style=flat-square)](https://www.npmjs.com/package/@nxuss/lemma)
 [![License](https://img.shields.io/npm/l/@nxuss/lemma.svg?color=blue&style=flat-square)](https://github.com/Nxusbets/lemma/blob/main/LICENSE)
@@ -302,4 +302,59 @@ Add the following to your `claude_desktop_config.json` configuration file:
 
 ---
 
+## 🔒 Security & Privacy
+
+### Network Binding
+By default, Lemma binds only to `127.0.0.1` (localhost). It is **not accessible from the network** unless you explicitly set:
+```env
+LEMMA_BIND_HOST=0.0.0.0
+```
+> ⚠️ If you do expose Lemma to the network, always enable authentication first:
+> ```env
+> AUTH_ENABLED=true
+> AUTH_REQUIRE_API_KEY=true
+> AUTH_ALLOWED_ORIGINS=https://yourdomain.com
+> ```
+
+### 📋 Clipboard Watcher Disclosure
+The **Clipboard Telepathic Watcher** polls your system clipboard every 1 second to automatically compress code you copy. This is disclosed in the startup banner. To disable it:
+```env
+# In your .env
+LEMMA_DISABLE_CLIPBOARD=true
+```
+Or via CLI flag: `lemma start --no-clipboard`
+
+### MCP Command Allowlist
+The `run_workspace_command` MCP tool only executes commands from an allowlist. Default safe prefixes include `npm`, `npx`, `git`, `tsc`, `node`, `jest`, `eslint`, `ls`, `grep`, and more.
+
+To extend the allowlist for your project, add to `lemma.config.json`:
+```json
+{
+  "mcp": {
+    "allowedCommandPrefixes": ["your-tool", "another-cmd"]
+  }
+}
+```
+
+### License Security (Cloud Server)
+When running the cloud server in production, set a private license salt:
+```env
+# Generate with: openssl rand -hex 32
+LEMMA_LICENSE_SALT=your-random-64-char-hex-string
+```
+
+### Stripe Webhooks (Cloud Server)
+The Stripe webhook endpoint requires a webhook signing secret in production:
+```env
+STRIPE_WEBHOOK_SECRET=whsec_...
+```
+Get this from **Stripe Dashboard → Developers → Webhooks → Signing Secret**. Without it, the endpoint is disabled in `NODE_ENV=production`.
+
+For local testing: `STRIPE_SKIP_SIGNATURE_VERIFY=true`
+
+### Full Security Template
+See [`.env.security.example`](.env.security.example) for all security-related environment variables.
+
+---
+
 MIT © Nxus Studio | [Upgrade to Lemma Pro](https://lemma.nxus.studio/upgrade)

package/dist/cjs/cli/lemma-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lemma-proxy.d.ts","sourceRoot":"","sources":["../../../src/cli/lemma-proxy.ts"],"names":[],"mappings":";AA0bA,wBAAgB,+BAA+B,CAAC,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA4DvF;AA2iED,wBAAsB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6KhL"}
+{"version":3,"file":"lemma-proxy.d.ts","sourceRoot":"","sources":["../../../src/cli/lemma-proxy.ts"],"names":[],"mappings":";AA0bA,wBAAgB,+BAA+B,CAAC,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA4DvF;AA2jED,wBAAsB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6KhL"}

package/dist/cjs/cli/lemma-proxy.js

@@ -2006,14 +2006,23 @@ Adjusted Answer:`;
             }
             throw e;
         });
-        server.listen(this.port, async () => {
+        const BIND_HOST = process.env.LEMMA_BIND_HOST || '127.0.0.1';
+        server.listen(this.port, BIND_HOST, async () => {
             fs_1.default.writeFileSync(PID_FILE, String(process.pid));
             fs_1.default.writeFileSync(PORT_FILE, String(this.port));
+            // Security warning if binding to all interfaces without auth
+            if (BIND_HOST !== '127.0.0.1' && BIND_HOST !== 'localhost') {
+                const authEnabled = process.env.AUTH_ENABLED === 'true';
+                if (!authEnabled) {
+                    console.warn(`\n\x1b[33m⚠️  [SECURITY] Lemma proxy is bound to ${BIND_HOST} (all interfaces) with AUTH_ENABLED=false.`);
+                    console.warn(`   Set AUTH_ENABLED=true and AUTH_REQUIRE_API_KEY=true before exposing to any network.\x1b[0m\n`);
+                }
+            }
             const pro = await isPro();
             console.log(`\x1b[1m\x1b[35m┌──────────────────────────────────────────────────────────┐\x1b[0m`);
             console.log(`\x1b[1m\x1b[35m│   🚀 LEMMA PROXY v${VERSION} — THE UNIVERSAL AI GATEWAY      │\x1b[0m`);
             console.log(`\x1b[1m\x1b[35m└──────────────────────────────────────────────────────────┘\x1b[0m`);
-            console.log(`\n📁 Project : ${this.projectName}\n🔌 Port    : ${this.port}`);
+            console.log(`\n📁 Project : ${this.projectName}\n🔌 Port    : ${this.port}  (bound to ${BIND_HOST})`);
             if (this.dashboardPath && fs_1.default.existsSync(this.dashboardPath)) {
                 console.log(`📊 Dashboard UI          : \x1b[36mhttp://localhost:${this.port}/dashboard/\x1b[0m`);
                 if (this.openBrowser) {
@@ -2052,12 +2061,19 @@ Adjusted Answer:`;
             console.log(`\n   \x1b[1m\x1b[33mlemma mcp\x1b[0m\n`);
             console.log('────────────────────────────────────────────────\n');
             // Auto-start the Local Clipboard Optimizer Watcher in the background
-            try {
-                const { startClipboardWatcher } = require('../utils/ClipboardWatcher');
-                startClipboardWatcher(1000);
+            const clipboardDisabled = process.env.LEMMA_DISABLE_CLIPBOARD === 'true';
+            if (clipboardDisabled) {
+                console.log(`📋 Clipboard Watcher     : \x1b[90m[DISABLED via LEMMA_DISABLE_CLIPBOARD]\x1b[0m`);
             }
-            catch (err) {
-                console.warn(`⚠️ Could not auto-initialize Clipboard Watcher: ${err.message}`);
+            else {
+                console.log(`📋 Clipboard Watcher     : \x1b[33m[ACTIVE]\x1b[0m — polling clipboard every 1s (disable: LEMMA_DISABLE_CLIPBOARD=true)`);
+                try {
+                    const { startClipboardWatcher } = require('../utils/ClipboardWatcher');
+                    startClipboardWatcher(1000);
+                }
+                catch (err) {
+                    console.warn(`⚠️ Could not auto-initialize Clipboard Watcher: ${err.message}`);
+                }
             }
         });
         process.on('SIGTERM', () => server.close());