@pixelbyte-software/pixcode 1.54.0 → 1.54.1

package/server/routes/git.js

@@ -887,7 +887,7 @@ router.post('/initial-commit', async (req, res) => {
       });
     }
 
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -918,7 +918,7 @@ router.post('/commit', async (req, res) => {
     res.json({ success: true, output: stdout });
   } catch (error) {
     console.error('Git commit error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -965,7 +965,7 @@ router.post('/revert-local-commit', async (req, res) => {
     });
   } catch (error) {
     console.error('Git revert local commit error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1031,7 +1031,7 @@ router.post('/checkout', async (req, res) => {
     res.json({ success: true, output: stdout });
   } catch (error) {
     console.error('Git checkout error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1053,7 +1053,7 @@ router.post('/create-branch', async (req, res) => {
     res.json({ success: true, output: stdout });
   } catch (error) {
     console.error('Git create branch error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1079,7 +1079,7 @@ router.post('/delete-branch', async (req, res) => {
     res.json({ success: true, output: stdout });
   } catch (error) {
     console.error('Git delete branch error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1234,7 +1234,7 @@ router.post('/generate-commit-message', async (req, res) => {
     res.json({ message });
   } catch (error) {
     console.error('Generate commit message error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1764,7 +1764,7 @@ router.post('/discard', async (req, res) => {
     res.json({ success: true, message: `Changes discarded for ${repositoryRelativeFilePath}` });
   } catch (error) {
     console.error('Git discard error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 
@@ -1815,7 +1815,7 @@ router.post('/delete-untracked', async (req, res) => {
     }
   } catch (error) {
     console.error('Git delete untracked error:', error);
-    res.status(500).json({ error: error.message });
+    res.status(500).json({ error: "Internal server error" });
   }
 });
 

package/server/routes/live-view.js

@@ -298,7 +298,7 @@ router.post('/:projectName/restart', requireLiveViewProjectAccess('useShell'), a
       environment: attachEnvironmentRuntimeState(state.environment, urls, tunnel),
     });
   } catch (error) {
-    res.status(500).json({ error: error.message || 'Failed to restart Live View' });
+    res.status(500).json({ error: 'Failed to restart Live View' });
   }
 });
 
@@ -315,7 +315,7 @@ router.post('/:projectName/stop', requireLiveViewProjectAccess('useShell'), asyn
       environment: attachEnvironmentRuntimeState(null, urls, tunnel),
     });
   } catch (error) {
-    res.status(500).json({ error: error.message || 'Failed to stop Live View' });
+    res.status(500).json({ error: 'Failed to stop Live View' });
   }
 });
 

package/server/routes/plugins.js

@@ -317,7 +317,7 @@ router.get('/marketplace', (req, res) => {
       categories: ['popular', 'skills', 'plugin', 'workflow', 'new'],
     });
   } catch (err) {
-    res.status(500).json({ error: 'Failed to read marketplace', details: err.message });
+    res.status(500).json({ error: 'Failed to read marketplace' });
   }
 });
 
@@ -358,7 +358,7 @@ router.get('/marketplace/search', async (req, res) => {
     res.json({ entries });
   } catch (err) {
     const status = err?.name === 'AbortError' ? 504 : 502;
-    res.status(status).json({ error: 'GitHub search failed', details: err.message });
+    res.status(status).json({ error: 'GitHub search failed' });
   } finally {
     clearTimeout(timeout);
   }
@@ -378,7 +378,7 @@ router.post('/marketplace/sources', (req, res) => {
     writeMarketplaceSources(sources.slice(0, 200));
     res.json({ success: true, source, installedSources: readMarketplaceSources() });
   } catch (err) {
-    res.status(400).json({ error: 'Failed to add source', details: err.message });
+    res.status(400).json({ error: 'Failed to add source' });
   }
 });
 
@@ -391,7 +391,7 @@ router.delete('/marketplace/sources/:id', (req, res) => {
     writeMarketplaceSources(next);
     res.json({ success: true, installedSources: next });
   } catch (err) {
-    res.status(400).json({ error: 'Failed to remove source', details: err.message });
+    res.status(400).json({ error: 'Failed to remove source' });
   }
 });
 
@@ -404,7 +404,7 @@ router.get('/', (req, res) => {
     }));
     res.json({ plugins });
   } catch (err) {
-    res.status(500).json({ error: 'Failed to scan plugins', details: err.message });
+    res.status(500).json({ error: 'Failed to scan plugins' });
   }
 });
 
@@ -421,7 +421,7 @@ router.get('/:name/manifest', (req, res) => {
     }
     res.json(plugin);
   } catch (err) {
-    res.status(500).json({ error: 'Failed to read plugin manifest', details: err.message });
+    res.status(500).json({ error: 'Failed to read plugin manifest' });
   }
 });
 
@@ -512,7 +512,7 @@ router.put('/:name/enable', async (req, res) => {
 
     res.json({ success: true, name: req.params.name, enabled });
   } catch (err) {
-    res.status(500).json({ error: 'Failed to update plugin', details: err.message });
+    res.status(500).json({ error: 'Failed to update plugin' });
   }
 });
 
@@ -545,7 +545,7 @@ router.post('/install', async (req, res) => {
 
     res.json({ success: true, plugin: manifest });
   } catch (err) {
-    res.status(400).json({ error: 'Failed to install plugin', details: err.message });
+    res.status(400).json({ error: 'Failed to install plugin' });
   }
 });
 
@@ -579,7 +579,7 @@ router.post('/:name/update', async (req, res) => {
 
     res.json({ success: true, plugin: manifest });
   } catch (err) {
-    res.status(400).json({ error: 'Failed to update plugin', details: err.message });
+    res.status(400).json({ error: 'Failed to update plugin' });
   }
 });
 
@@ -610,7 +610,7 @@ router.all(/^\/([a-zA-Z0-9_-]+)\/rpc\/(.*)$/, async (req, res) => {
     try {
       port = await startPluginServer(pluginName, pluginDir, plugin.server);
     } catch (err) {
-      return res.status(503).json({ error: 'Plugin server failed to start', details: err.message });
+      return res.status(503).json({ error: 'Plugin server failed to start' });
     }
   }
 
@@ -646,7 +646,7 @@ router.all(/^\/([a-zA-Z0-9_-]+)\/rpc\/(.*)$/, async (req, res) => {
 
   proxyReq.on('error', (err) => {
     if (!res.headersSent) {
-      res.status(502).json({ error: 'Plugin server error', details: err.message });
+      res.status(502).json({ error: 'Plugin server error' });
     } else {
       res.end();
     }
@@ -683,7 +683,7 @@ router.delete('/:name', async (req, res) => {
     await uninstallPlugin(pluginName);
     res.json({ success: true, name: pluginName });
   } catch (err) {
-    res.status(400).json({ error: 'Failed to uninstall plugin', details: err.message });
+    res.status(400).json({ error: 'Failed to uninstall plugin' });
   }
 });
 

package/server/routes/projects.js

@@ -326,7 +326,7 @@ router.get('/:projectName/dir-status', requireAdmin, async (req, res) => {
     }
   } catch (error) {
     console.error(`[projects] dir-status ${projectName}:`, error);
-    res.status(500).json({ error: error.message || 'Failed to check project directory' });
+    res.status(500).json({ error: 'Failed to check project directory' });
   }
 });
 
@@ -410,7 +410,7 @@ router.post('/quick-start', requireAdmin, async (req, res) => {
     res.json({ success: true, project, suggestedName: name, reused: false });
   } catch (error) {
     console.error('[projects] quick-start failed:', error);
-    res.status(500).json({ error: error.message || 'Failed to quick-start project' });
+    res.status(500).json({ error: 'Failed to quick-start project' });
   }
 });
 

package/server/routes/qwen.js

@@ -20,7 +20,7 @@ router.delete('/sessions/:sessionId', async (req, res) => {
         res.json({ success: true });
     } catch (error) {
         console.error(`Error deleting Qwen session ${req.params.sessionId}:`, error);
-        res.status(500).json({ success: false, error: error.message });
+        res.status(500).json({ success: false, error: "Internal server error" });
     }
 });
 

package/server/routes/remote.js

@@ -42,7 +42,7 @@ router.get('/control-room', async (_req, res) => {
       controlRoom: await buildControlRoomSnapshot(),
     });
   } catch (error) {
-    res.status(500).json({ success: false, error: error.message });
+    res.status(500).json({ success: false, error: "Internal server error" });
   }
 });
 

package/server/routes/webhooks.js

@@ -56,7 +56,7 @@ router.post('/test', async (req, res) => {
     });
     res.json({ success: true, result });
   } catch (error) {
-    res.status(500).json({ success: false, error: error.message });
+    res.status(500).json({ success: false, error: "Internal server error" });
   }
 });
 

package/server/services/startup-update.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import { spawn, spawnSync } from 'node:child_process';
 import { Readable } from 'node:stream';
 
@@ -68,10 +69,14 @@ async function readLatestPackageMetadata() {
   const latestVersion = metadata?.['dist-tags']?.latest;
   const latestEntry = latestVersion ? metadata?.versions?.[latestVersion] : null;
   const tarballUrl = latestEntry?.dist?.tarball;
+  const integrity = latestEntry?.dist?.integrity;
   if (!latestVersion || !tarballUrl) {
     throw new Error('Registry response missing latest version or tarball URL.');
   }
-  return { latestVersion, tarballUrl };
+  if (!integrity) {
+    console.warn('[startup-update] Registry response missing integrity hash — proceeding without verification.');
+  }
+  return { latestVersion, tarballUrl, integrity };
 }
 
 async function installNpmGlobal(latestVersion, color) {
@@ -119,7 +124,7 @@ function readPackageVersion(appRoot) {
   }
 }
 
-async function extractRuntimeTarball({ runtimeDir, tarballUrl, latestVersion, currentVersion, color }) {
+async function extractRuntimeTarball({ runtimeDir, tarballUrl, latestVersion, currentVersion, color, integrity }) {
   color?.info && console.log(`${color.info('[INFO]')} Updating runtime ${currentVersion} -> ${latestVersion} before opening the port...`);
 
   const tarballRes = await fetch(tarballUrl);
@@ -127,6 +132,27 @@ async function extractRuntimeTarball({ runtimeDir, tarballUrl, latestVersion, cu
     throw new Error(`Tarball fetch failed: HTTP ${tarballRes.status}`);
   }
 
+  // Download tarball to a buffer first so we can verify integrity before extracting.
+  const tarballBuffer = Buffer.from(await tarballRes.arrayBuffer());
+
+  // Verify integrity hash (SRI format: "sha512-<base64>") if provided by the registry.
+  if (integrity && typeof integrity === 'string') {
+    const match = integrity.match(/^(sha512)-(.+)$/);
+    if (match) {
+      const algo = match[1];
+      const expectedHash = match[2];
+      const actualHash = crypto.createHash(algo).update(tarballBuffer).digest('base64');
+      if (actualHash !== expectedHash) {
+        throw new Error(`Integrity verification failed: expected ${algo}-${expectedHash.slice(0, 16)}..., got ${algo}-${actualHash.slice(0, 16)}...`);
+      }
+      color?.info && console.log(`${color.info('[INFO]')} Tarball integrity verified (${algo}).`);
+    } else {
+      console.warn('[startup-update] Unrecognized integrity format — skipping verification.');
+    }
+  } else {
+    console.warn('[startup-update] No integrity hash available — tarball extracted without verification.');
+  }
+
   const stagingDir = path.join(runtimeDir, '.staging');
   const backupDir = path.join(runtimeDir, '.previous');
   fs.rmSync(stagingDir, { recursive: true, force: true });
@@ -137,9 +163,7 @@ async function extractRuntimeTarball({ runtimeDir, tarballUrl, latestVersion, cu
   if (!tarExtract) throw new Error('tar extractor not available');
 
   await new Promise((resolve, reject) => {
-    const nodeStream = typeof Readable.fromWeb === 'function' && tarballRes.body?.getReader
-      ? Readable.fromWeb(tarballRes.body)
-      : tarballRes.body;
+    const nodeStream = Readable.from(tarballBuffer);
     const extractor = tarExtract({ cwd: stagingDir, strip: 1 });
     nodeStream.pipe(extractor);
     extractor.on('finish', resolve);
@@ -199,7 +223,7 @@ export async function runStartupAutoUpdate({
       return await updateGitCheckout(appRoot, color);
     }
 
-    const { latestVersion, tarballUrl } = await readLatestPackageMetadata();
+    const { latestVersion, tarballUrl, integrity } = await readLatestPackageMetadata();
     if (compareVersions(latestVersion, currentVersion) <= 0) {
       return { updated: false, latestVersion };
     }
@@ -211,6 +235,7 @@ export async function runStartupAutoUpdate({
         latestVersion,
         currentVersion,
         color,
+        integrity,
       });
       return { updated: true, version: latestVersion, restartMode: 'exit42' };
     }

package/server/services/telegram/bot.js

@@ -1,4 +1,5 @@
 import { EventEmitter } from 'node:events';
+import crypto from 'node:crypto';
 
 import { telegramConfigDb, telegramLinksDb } from '../../database/db.js';
 
@@ -43,10 +44,11 @@ export const telegramEvents = new EventEmitter();
 const now = () => Date.now();
 
 const generate6DigitCode = () => {
-  // Zero-padded random 6-digit code. Using rand instead of crypto is fine
-  // here: the code is short-lived (10min), single-use, and verified against
-  // a per-user row — brute-force requires both the code AND a live pairing.
-  const n = Math.floor(Math.random() * 1_000_000);
+  // Zero-padded random 6-digit code. Using crypto.randomInt prevents
+  // modulo bias and ensures uniform distribution across the 000000–999999
+  // range. The code is short-lived (10min), single-use, and verified
+  // against a per-user row.
+  const n = crypto.randomInt(0, 1_000_000);
   return n.toString().padStart(6, '0');
 };
 

package/server/setup-wizard.js

@@ -3,7 +3,7 @@ import os from 'os';
 import path from 'path';
 import net from 'node:net';
 import readline from 'readline';
-import { exec } from 'node:child_process';
+import { spawn } from 'node:child_process';
 
 import { c } from './utils/colors.js';
 
@@ -108,16 +108,22 @@ async function askSelect(question, options) {
 
 function openBrowser(url) {
     const platform = process.platform;
-    let cmd;
+    // Use spawn with an argument array instead of exec with a shell string
+    // to prevent command injection through the url value.
+    let bin;
+    let args;
     if (platform === 'darwin') {
-        cmd = `open "${url}"`;
+        bin = 'open';
+        args = [url];
     } else if (platform === 'win32') {
-        cmd = `start "" "${url}"`;
+        bin = 'cmd';
+        args = ['/c', 'start', '', url];
     } else {
-        cmd = `xdg-open "${url}"`;
+        bin = 'xdg-open';
+        args = [url];
     }
     try {
-        exec(cmd, { stdio: 'ignore', timeout: 3000 });
+        spawn(bin, args, { stdio: 'ignore', timeout: 3000, detached: true, shell: false }).unref();
         return true;
     } catch {
         return false;

package/server/utils/plugin-loader.js

@@ -3,6 +3,8 @@ import path from 'path';
 import os from 'os';
 import { spawn } from 'child_process';
 
+import { securityLog } from './security-log.js';
+
 const PLUGINS_DIR = path.join(os.homedir(), '.pixcode', 'plugins');
 const PLUGINS_CONFIG_PATH = path.join(os.homedir(), '.pixcode', 'plugins.json');
 
@@ -290,6 +292,7 @@ export function installPluginFromGit(url) {
         cleanupTemp();
         return reject(new Error(`Failed to move plugin into place: ${err.message}`));
       }
+      securityLog('plugin_installed', { reason: manifest.name });
       resolve(manifest);
     };
 
@@ -303,6 +306,7 @@ export function installPluginFromGit(url) {
     gitProcess.on('close', (code) => {
       if (code !== 0) {
         cleanupTemp();
+        securityLog('plugin_install_failed', { reason: `git clone failed: exit code ${code}` });
         return reject(new Error(`git clone failed (exit code ${code}): ${stderr.trim()}`));
       }
 

package/server/utils/port-access.js

@@ -2,7 +2,7 @@ import os from 'os';
 import fs from 'fs';
 import path from 'path';
 import readline from 'readline';
-import { execSync } from 'child_process';
+import { execSync, spawnSync } from 'child_process';
 
 import { c } from './colors.js';
 
@@ -65,7 +65,7 @@ function tryUfw(port) {
     const status = execSync('ufw status', { stdio: 'pipe', encoding: 'utf8' });
     // UFW inactive = no rule needed; the port is already reachable.
     if (!/active/i.test(status)) return 'inactive';
-    execSync(`sudo -n ufw allow ${port}/tcp`, { stdio: 'pipe' });
+    execSync('sudo -n ufw allow ' + String(port) + '/tcp', { stdio: 'pipe' });
     return 'applied';
   } catch {
     return null;
@@ -77,7 +77,7 @@ function tryFirewalld(port) {
     execSync('command -v firewall-cmd', { stdio: 'pipe' });
     const state = execSync('firewall-cmd --state', { stdio: 'pipe', encoding: 'utf8' });
     if (!/running/i.test(state)) return 'inactive';
-    execSync(`sudo -n firewall-cmd --add-port=${port}/tcp --permanent`, { stdio: 'pipe' });
+    execSync('sudo -n firewall-cmd --add-port=' + String(port) + '/tcp --permanent', { stdio: 'pipe' });
     execSync('sudo -n firewall-cmd --reload', { stdio: 'pipe' });
     return 'applied';
   } catch {
@@ -89,12 +89,19 @@ function tryFirewalld(port) {
 
 function applyWindowsRule(port) {
   const ruleName = `Pixcode-${port}`;
-  const cmd = `netsh advfirewall firewall add rule name="${ruleName}" dir=in action=allow protocol=TCP localport=${port}`;
+  // Use spawnSync with an argument array instead of execSync with a shell
+  // string to prevent command injection. Port is validated as an integer
+  // at the entry point, but this is defense-in-depth.
   try {
-    execSync(cmd, { stdio: 'pipe' });
-    return { ok: true, cmd, ruleName };
+    spawnSync('netsh', [
+      'advfirewall', 'firewall', 'add', 'rule',
+      `name=${ruleName}`,
+      'dir=in', 'action=allow', 'protocol=TCP',
+      `localport=${port}`,
+    ], { stdio: 'pipe', shell: false });
+    return { ok: true, ruleName };
   } catch (error) {
-    return { ok: false, cmd, ruleName, error: error.message };
+    return { ok: false, ruleName, error: error.message };
   }
 }
 
@@ -125,6 +132,16 @@ function macFirewallHint(port) {
  * without any firewall change.
  */
 export async function ensurePortOpen(port) {
+  // Validate port is a safe integer to prevent command injection via the
+  // firewall commands below. The caller passes SERVER_PORT which comes from
+  // env, so this is defense-in-depth against a tampered environment.
+  const safePort = Number.parseInt(port, 10);
+  if (!Number.isInteger(safePort) || safePort < 1 || safePort > 65535) {
+    console.log(`${c.dim('[INFO]')} Skipping firewall setup: invalid port value.`);
+    return;
+  }
+  port = safePort;
+
   const state = loadState();
   const key = `port:${port}`;
   const entry = state[key];
@@ -185,8 +202,9 @@ export async function ensurePortOpen(port) {
       console.log(`${c.ok('[OK]')}   Firewall rule "${result.ruleName}" added.`);
       saveState({ ...state, [key]: { decision: 'allow', status: 'applied', via: 'windows' } });
     } else {
+      const manualCmd = `netsh advfirewall firewall add rule name="Pixcode-${port}" dir=in action=allow protocol=TCP localport=${port}`;
       console.log(`${c.tip('[TIP]')}  Adding the rule needs Administrator. Run this in an elevated PowerShell:`);
-      console.log(`       ${c.bright(result.cmd)}`);
+      console.log(`       ${c.bright(manualCmd)}`);
       saveState({ ...state, [key]: { decision: 'allow', status: 'manual' } });
     }
     return;

package/server/utils/security-log.js

@@ -0,0 +1,84 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+const LOG_DIR = path.join(os.homedir(), '.pixcode', 'logs');
+const SECURITY_LOG_PATH = path.join(LOG_DIR, 'security.log');
+const MAX_LOG_SIZE = 10 * 1024 * 1024;
+const MAX_LOG_FILES = 5;
+
+function ensureLogDir() {
+    try {
+        if (!fs.existsSync(LOG_DIR)) {
+            fs.mkdirSync(LOG_DIR, { recursive: true, mode: 0o700 });
+        }
+    } catch {
+        // Non-fatal: if we can't create the log dir, we fall back to console
+    }
+}
+
+function sanitizeForLog(value) {
+    if (typeof value !== 'string') {
+        try {
+            value = String(value ?? '');
+        } catch {
+            return '[unserializable]';
+        }
+    }
+    return value
+        .replace(/[\r\n\t]/g, ' ')
+        .replace(/\x1b\[[0-9;]*m/g, '')
+        .slice(0, 500);
+}
+
+function rotateLogIfNeeded() {
+    try {
+        if (!fs.existsSync(SECURITY_LOG_PATH)) return;
+        const stats = fs.statSync(SECURITY_LOG_PATH);
+        if (stats.size < MAX_LOG_SIZE) return;
+        for (let i = MAX_LOG_FILES - 1; i >= 1; i--) {
+            const oldPath = `${SECURITY_LOG_PATH}.${i}`;
+            const newPath = `${SECURITY_LOG_PATH}.${i + 1}`;
+            if (fs.existsSync(oldPath)) {
+                try { fs.renameSync(oldPath, newPath); } catch { /* noop */ }
+            }
+        }
+        try { fs.renameSync(SECURITY_LOG_PATH, `${SECURITY_LOG_PATH}.1`); } catch { /* noop */ }
+    } catch {
+        // Non-fatal
+    }
+}
+
+export function securityLog(event, details = {}) {
+    const entry = {
+        timestamp: new Date().toISOString(),
+        event,
+        ip: sanitizeForLog(details.ip),
+        userId: details.userId != null ? String(details.userId) : null,
+        username: details.username ? sanitizeForLog(details.username) : null,
+        endpoint: details.endpoint ? sanitizeForLog(details.endpoint) : null,
+        method: details.method ? sanitizeForLog(details.method) : null,
+        statusCode: details.statusCode || null,
+        reason: details.reason ? sanitizeForLog(details.reason) : null,
+        userAgent: details.userAgent ? sanitizeForLog(details.userAgent) : null,
+    };
+
+    const line = JSON.stringify(entry);
+
+    try {
+        ensureLogDir();
+        rotateLogIfNeeded();
+        fs.appendFileSync(SECURITY_LOG_PATH, line + '\n', { mode: 0o600 });
+    } catch {
+        // Fall back to console if file logging fails
+        console.warn('[SECURITY]', line);
+    }
+}
+
+export function getClientIp(req) {
+    const forwarded = req?.headers?.['x-forwarded-for'];
+    if (typeof forwarded === 'string' && forwarded.trim()) {
+        return forwarded.split(',')[0].trim();
+    }
+    return req?.socket?.remoteAddress || req?.ip || 'unknown';
+}