@raidiant/notifai 8.0.0 → 9.1.0

package/src/cli-release.ts

@@ -0,0 +1,78 @@
+import { packageVersion } from './release.js'
+
+/**
+ * The newest published CLI, read from the registry that publishes it.
+ *
+ * Which version is newest is a registry fact. Doctor consults it as a
+ * best-effort, cached, short-timeout hint: never fatal, and never on a
+ * non-interactive or CI invocation — those callers already get structured
+ * support state from the server when they are signed in.
+ */
+const DIST_TAGS_URL = 'https://registry.npmjs.org/-/package/@raidiant/notifai/dist-tags'
+const REQUEST_TIMEOUT_MS = 2_000
+const CACHE_TTL_MS = 60 * 60 * 1000
+
+let cached: { value: string | null; at: number } | null = null
+
+export function compareCliSemVer(left: string, right: string): number | null {
+  const parse = (value: string): [number, number, number] | null => {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(value)
+    if (!match) return null
+    return [Number(match[1]), Number(match[2]), Number(match[3])]
+  }
+  const a = parse(left)
+  const b = parse(right)
+  if (a === null || b === null) return null
+  for (let index = 0; index < 3; index += 1) {
+    if (a[index] !== b[index]) return a[index]! - b[index]!
+  }
+  return 0
+}
+
+export function shouldConsultCliRegistry(input: {
+  interactive?: boolean
+  json?: boolean
+  env?: NodeJS.ProcessEnv
+}): boolean {
+  if (input.json === true) return false
+  if (input.interactive !== true) return false
+  const ci = input.env?.['CI']
+  return ci !== '1' && ci !== 'true'
+}
+
+export async function latestPublishedCliVersion(
+  fetchImpl: typeof fetch = fetch,
+): Promise<string | null> {
+  if (cached !== null && Date.now() - cached.at < CACHE_TTL_MS) return cached.value
+  try {
+    const response = await fetchImpl(DIST_TAGS_URL, {
+      headers: { accept: 'application/json' },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    })
+    if (!response.ok) return cached?.value ?? null
+    const body: unknown = await response.json()
+    if (typeof body !== 'object' || body === null) return cached?.value ?? null
+    const latest = (body as { latest?: unknown }).latest
+    if (typeof latest !== 'string' || compareCliSemVer(latest, '0.0.0') === null) {
+      return cached?.value ?? null
+    }
+    cached = { value: latest, at: Date.now() }
+    return latest
+  } catch {
+    return cached?.value ?? null
+  }
+}
+
+export function newerPublishedCli(local: string | null, latest: string | null): string | null {
+  if (local === null || latest === null) return null
+  const comparison = compareCliSemVer(latest, local)
+  return comparison !== null && comparison > 0 ? latest : null
+}
+
+export function thisCliVersion(): string | null {
+  return packageVersion()
+}
+
+export function resetLatestPublishedCliVersionForTest(): void {
+  cached = null
+}

package/src/client.test.ts

@@ -81,6 +81,69 @@ describe('a server that never answers', () => {
     expect(result.replies).toEqual([])
   })
 
+  it('encodes pairing and evidence path segments', async () => {
+    const seen: string[] = []
+    const baseUrl = await serving((request, response) => {
+      seen.push(`${request.method} ${request.url}`)
+      response.setHeader('content-type', 'application/json')
+      if (request.url?.includes('/poll')) {
+        response.end(JSON.stringify({ status: 'pending' }))
+        return
+      }
+      response.end(
+        JSON.stringify({
+          request_id: 'req/encoded',
+          overall: 'accepted',
+          deliveries: [],
+          warnings: [],
+        }),
+      )
+    })
+    const client = createClient(baseUrl, 'Bearer test')
+
+    await client.pollPairing('pair/id', 'verifier')
+    await client.evidence('req/encoded')
+
+    expect(seen).toEqual([
+      'POST /api/v1/pairings/pair%2Fid/poll',
+      'GET /api/v1/notifications/req%2Fencoded',
+    ])
+  })
+
+  it('refuses redirects on bearer-authenticated calls', async () => {
+    let followed = false
+    const baseUrl = await serving((request, response) => {
+      if (request.url === '/api/v1/devices') {
+        response.statusCode = 302
+        response.setHeader('location', '/stolen')
+        response.end()
+        return
+      }
+      followed = true
+      response.end('stolen')
+    })
+
+    await expect(createClient(baseUrl, 'Bearer secret').listDevices()).rejects.toBeInstanceOf(
+      NetworkError,
+    )
+    expect(followed).toBe(false)
+  })
+
+  it('still follows redirects when the call has no bearer', async () => {
+    const baseUrl = await serving((request, response) => {
+      if (request.url === '/healthz') {
+        response.statusCode = 302
+        response.setHeader('location', '/healthz-ok')
+        response.end()
+        return
+      }
+      response.setHeader('content-type', 'application/json')
+      response.end('{}')
+    })
+
+    await expect(createClient(baseUrl, null).health()).resolves.toBe(true)
+  })
+
   it('puts and fetches Agent Acknowledgements on the encoded request path', async () => {
     const seen: { method?: string; url?: string; body?: unknown }[] = []
     const baseUrl = await serving((request, response) => {
@@ -180,6 +243,38 @@ describe('a server that never answers', () => {
     ])
   })
 
+  it('refuses a signed upload redirect without replaying its headers or finalizing', async () => {
+    let followed = false
+    let finalized = false
+    const baseUrl = await serving((request, response) => {
+      if (request.url === '/signed-upload') {
+        response.statusCode = 302
+        response.setHeader('location', `${baseUrl}/stolen`)
+        response.end()
+        return
+      }
+      if (request.url === '/stolen') followed = true
+      if (request.url === '/api/v1/media/med_1/finalize') finalized = true
+      response.statusCode = 200
+      response.end()
+    })
+    const client = createClient(baseUrl, 'Bearer machine')
+
+    await expect(
+      client.uploadMedia(
+        {
+          media_id: 'med_1',
+          upload_url: `${baseUrl}/signed-upload`,
+          upload_headers: { authorization: 'Signed secret' },
+          expires_at: '2026-08-14T12:00:00.000Z',
+        },
+        new Uint8Array([1, 2, 3, 4]),
+      ),
+    ).rejects.toThrow(/redirect is refused/i)
+    expect(followed).toBe(false)
+    expect(finalized).toBe(false)
+  })
+
   it('treats a truncated body as a transport failure, not a crash', async () => {
     // A body that stops mid-JSON used to escape as a raw parse error outside
     // the retry path, so nothing backed off and retried it.

package/src/client.ts

@@ -71,6 +71,7 @@ export interface ApiClient {
     machine_name: string
     credential_hash: string
     poll_verifier_hash: string
+    confirmation_hash: string
   }): Promise<BeginPairingResponse>
   pollPairing(pairingId: string, pollVerifier: string): Promise<PollPairingResponse>
   accessStatus(): Promise<AccountAccessResponse>
@@ -209,6 +210,7 @@ export function createClient(
           ...clientHeaders,
         },
         signal,
+        ...(bearer ? { redirect: 'error' as const } : {}),
         ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
       })
     } catch (err) {
@@ -243,7 +245,9 @@ export function createClient(
   return {
     beginPairing: (body) => call('POST', '/api/v1/pairings', body),
     pollPairing: (pairingId, pollVerifier) =>
-      call('POST', `/api/v1/pairings/${pairingId}/poll`, { poll_verifier: pollVerifier }),
+      call('POST', `/api/v1/pairings/${encodeURIComponent(pairingId)}/poll`, {
+        poll_verifier: pollVerifier,
+      }),
     accessStatus: () => call('GET', '/api/v1/account/access'),
     listDevices: () => call('GET', '/api/v1/devices'),
     capabilities: (platform = 'ios', appVersion, appBuild) => {
@@ -251,12 +255,12 @@ export function createClient(
       if (appVersion !== undefined) query.set('app_version', appVersion)
       if (appBuild !== undefined) query.set('app_build', appBuild)
       const suffix = query.size > 0 ? `?${query.toString()}` : ''
-      return call('GET', `/api/v1/capabilities/${platform}${suffix}`)
+      return call('GET', `/api/v1/capabilities/${encodeURIComponent(platform)}${suffix}`)
     },
     compatibility: () => call('GET', '/api/v1/compatibility'),
     submit: (body, waitSeconds) =>
       call('POST', `/api/v1/notifications?wait_seconds=${waitSeconds}`, body, waitSeconds),
-    evidence: (requestId) => call('GET', `/api/v1/notifications/${requestId}`),
+    evidence: (requestId) => call('GET', `/api/v1/notifications/${encodeURIComponent(requestId)}`),
     replies: (requestId, { waitSeconds, afterSeq }) =>
       call(
         'GET',
@@ -297,10 +301,19 @@ export function createClient(
           // Media can be large, so this gets its own allowance rather than the
           // per-request budget — but still a finite one.
           signal: AbortSignal.timeout(Math.max(budgetMs, 60_000)),
+          // The grant names one exact destination and carries signed headers.
+          // A redirect would replay both against an origin the server never
+          // granted, so it is refused rather than followed.
+          redirect: 'manual',
         })
       } catch (err) {
         throw new NetworkError(`Upload failed: ${String(err)}`)
       }
+      if (response.status >= 300 && response.status < 400) {
+        throw new NetworkError(
+          `Upload redirect is refused, not followed: the grant's headers are signed for one exact destination`,
+        )
+      }
       if (!response.ok) {
         throw new NetworkError(`Upload rejected with status ${response.status}`)
       }

package/src/command-session.ts

@@ -0,0 +1,38 @@
+import type { CommandDeps } from './commands-core.js'
+import { resolveActiveHarness } from './commands-harness-context.js'
+import { findOwningSession, readProjectSession } from './hooks.js'
+
+export interface ResolvedCommandSession {
+  sessionId: string
+  source: 'exact-harness' | 'stable-id' | 'project-pointer'
+}
+
+/**
+ * Resolve only Question Routing lifecycle ownership.
+ *
+ * Exact harness identity wins across checkouts. A stable question/request id
+ * wins next. The cwd pointer remains a compatibility fallback for shells that
+ * genuinely have no exact harness identity; it never owns Project or config
+ * scope, which stay with the command's invocation directory.
+ */
+export function resolveCommandSession(
+  deps: CommandDeps,
+  stableId?: string,
+): ResolvedCommandSession | null {
+  if (stableId !== undefined) {
+    const owner = findOwningSession(stableId, deps.env)
+    if (owner.ambiguous) return null
+    if (owner.sessionId !== null) return { sessionId: owner.sessionId, source: 'stable-id' }
+  }
+  const now = (deps.now ?? Date.now)()
+  const resolution = resolveActiveHarness(deps.env, deps.cwd, now)
+  if (resolution.contested.length > 0) return null
+  if (
+    resolution.active?.sessionId !== undefined &&
+    resolution.contested.length === 0
+  ) {
+    return { sessionId: resolution.active.sessionId, source: 'exact-harness' }
+  }
+  const pointer = readProjectSession(deps.cwd, deps.env, now)
+  return pointer === null ? null : { sessionId: pointer, source: 'project-pointer' }
+}

package/src/commands-auth.ts

@@ -4,6 +4,7 @@ import { randomBytes } from 'node:crypto'
 import os from 'node:os'
 import { NetworkError } from './client.js'
 import { type FlagOverrides } from './config.js'
+import { checkApproveUrl } from './url-policy.js'
 import {
   EXIT,
   authedClient,
@@ -17,6 +18,17 @@ import {
 // login / logout / auth status
 // ---------------------------------------------------------------------------
 
+/**
+ * Keep the one-time confirmation secret out of the HTTP request that opens
+ * the dashboard. URL fragments are browser-local and are not sent by GET,
+ * prefetchers, referrers, or link scanners.
+ */
+export function pairingApprovalUrl(approveUrl: string, confirmationSecret: string): string {
+  const url = new URL(approveUrl)
+  url.hash = new URLSearchParams({ confirmation_secret: confirmationSecret }).toString()
+  return url.toString()
+}
+
 export async function loginCommand(
   deps: CommandDeps,
   flags: { name?: string; baseUrl?: string; open?: boolean },
@@ -26,6 +38,7 @@ export async function loginCommand(
   const machineName = flags.name ?? os.hostname()
   const secret = randomBytes(32).toString('base64url')
   const pollVerifier = randomBytes(24).toString('base64url')
+  const confirmationSecret = randomBytes(32).toString('base64url')
   const client = makeClient(deps, baseUrl, null)
 
   let begin
@@ -34,21 +47,37 @@ export async function loginCommand(
       machine_name: machineName,
       credential_hash: sha256Hex(secret),
       poll_verifier_hash: sha256Hex(pollVerifier),
+      confirmation_hash: sha256Hex(confirmationSecret),
     })
   } catch (err) {
     return reportError(deps, err)
   }
+  const approveUrl = pairingApprovalUrl(begin.approve_url, confirmationSecret)
+
+  // The approval URL is the server's choice, and this machine is about to put
+  // it in front of the user's browser. A compromised or misconfigured service
+  // must not be able to aim that anywhere it likes, so the pairing stops here
+  // rather than showing a link the user would reasonably trust.
+  const approvable = checkApproveUrl(begin.approve_url, baseUrl, config.approve_origins.value)
+  if (!approvable.ok) {
+    deps.io.err(`Pairing stopped: ${approvable.reason}`)
+    deps.io.err(
+      'next: If you self-host with the dashboard on its own origin, allow it with ' +
+        '`notifai config set approve_origins <origin>` and run `notifai login` again.',
+    )
+    return EXIT.auth
+  }
 
   const interactive = deps.io.interactive === true
   if (interactive) {
     await deps.io.intro?.('Notifai sign in')
-    await deps.io.note?.(`Code: ${begin.code}\n${begin.approve_url}`, 'Approve this machine')
+    await deps.io.note?.(`Code: ${begin.code}\n${approveUrl}`, 'Approve this machine')
   } else {
     deps.io.out(`Pairing code: ${begin.code}`)
-    deps.io.out(`Approve this machine at: ${begin.approve_url}`)
+    deps.io.out(`Approve this machine at: ${approveUrl}`)
     deps.io.out('Waiting for approval…')
   }
-  if (flags.open !== false) deps.io.openUrl(begin.approve_url)
+  if (flags.open !== false) deps.io.openUrl(approveUrl)
 
   const expiresAt = new Date(begin.expires_at).getTime()
   const intervalMs = Math.max(begin.poll_interval_seconds, 1) * 1000

package/src/commands-config.ts

@@ -7,11 +7,14 @@ import {
 } from 'node:fs'
 import path from 'node:path'
 import { parse as parseToml, stringify as stringifyToml } from 'smol-toml'
+import { ensurePrivateDirectory } from './atomic-file.js'
 import { acceptedValues, configInfo } from './config-schema.js'
 import {
   BOOLEAN_CONFIG_KEYS,
   CONFIG_KEYS,
   NUMERIC_CONFIG_KEYS,
+  ORIGIN_LIST_CONFIG_KEYS,
+  USER_OWNED_CONFIG_KEYS,
   configBounds,
   configDefaultValue,
   findProjectConfigPath,
@@ -20,6 +23,7 @@ import {
   sessionConfigPath,
   type ConfigKey,
 } from './config.js'
+import { normalizeOrigin } from './url-policy.js'
 import { renderConfigExplain, renderConfigList, renderConfigPlain } from './ui/config-view.js'
 import { EXIT, loadLoggedConfig, type CommandDeps } from './commands-core.js'
 
@@ -189,10 +193,28 @@ export async function configSetCommand(
     deps.io.err(`${key} takes one of: ${info.choices.join(', ')} — not "${rawValue}".`)
     return EXIT.usage
   }
-  if (key === 'devices') value = rawValue.split(',').map((s) => s.trim()).filter(Boolean)
+  if (info.kind === 'list') value = rawValue.split(',').map((s) => s.trim()).filter(Boolean)
+  if (ORIGIN_LIST_CONFIG_KEYS.includes(configKey)) {
+    const origins = (value as string[]).map((entry) => normalizeOrigin(entry))
+    const rejected = (value as string[]).filter((_, index) => origins[index] === null)
+    if (rejected.length > 0) {
+      deps.io.err(
+        `${key} entries must be bare http(s) origins like "https://host" or "http://host:8080" — not ${rejected.map((entry) => `"${entry}"`).join(', ')}.`,
+      )
+      return EXIT.usage
+    }
+    value = origins
+  }
 
   const target = await configMutationTarget(deps, flags)
   if (target === null) return EXIT.usage
+  if (target.layer === 'project' && USER_OWNED_CONFIG_KEYS.includes(configKey)) {
+    deps.io.err(
+      `${key} widens which origins this machine trusts, so it is never read from the repository's shared config — a cloned repository must not be able to set it.`,
+    )
+    deps.io.err('Store it on this machine (no flag) or for this project personally (--local).')
+    return EXIT.usage
+  }
   if (target.layer === 'global' && Object.is(value, configDefaultValue(configKey))) {
     deps.io.err(`${key} is already the shipped default (${JSON.stringify(value)}).`)
     deps.io.err(
@@ -213,7 +235,8 @@ export async function configSetCommand(
     ? (parseToml(readFileSync(target.path, 'utf8')) as Record<string, unknown>)
     : {}
   existing[key] = value
-  mkdirSync(path.dirname(target.path), { recursive: true })
+  if (target.layer === 'project') mkdirSync(path.dirname(target.path), { recursive: true })
+  else ensurePrivateDirectory(path.dirname(target.path))
   writeFileSync(target.path, `${stringifyToml(existing)}\n`)
   deps.io.out(`Wrote ${key} to ${target.path}`)
   return EXIT.ok

package/src/commands-core.ts

@@ -84,6 +84,8 @@ export interface CommandDeps {
   nativeSkills?: NativeSkills
   /** Test seam for Orca's exact-worktree semantic title lookup. */
   orcaSessionTitle?: OrcaSessionTitleLookup
+  /** Test seam for registry reads; production uses fetch. */
+  fetchImpl?: typeof fetch
   /**
    * The local record of what this invocation did. Optional so a test fake need
    * not carry one; `log(deps)` supplies a logger that records nothing.
@@ -132,7 +134,36 @@ export function makeClient(
 }
 
 export function resolvedBaseUrl(config: CliConfig, credential: MachineCredential | null): string {
-  return config.base_url.source === 'default' && credential ? credential.baseUrl : config.base_url.value
+  return credential ? credential.baseUrl : config.base_url.value
+}
+
+/**
+ * Whether a flag or env origin would send signed-in traffic somewhere other
+ * than the origin stored with this machine's credential.
+ *
+ * Login still honours those overrides: pairing has no credential to pin to.
+ * Returning the source (not the override URL, and never the bearer) is what
+ * lets callers diagnose the ignore without leaking either.
+ */
+export function ignoredOriginOverride(
+  config: CliConfig,
+  credential: MachineCredential,
+): CliConfig['base_url']['source'] | null {
+  if (config.base_url.source === 'default') return null
+  if (config.base_url.value === credential.baseUrl) return null
+  return config.base_url.source
+}
+
+export function diagnoseIgnoredOriginOverride(
+  io: Pick<CommandIo, 'err'>,
+  config: CliConfig,
+  credential: MachineCredential,
+): void {
+  const source = ignoredOriginOverride(config, credential)
+  if (source === null) return
+  io.err(
+    `Ignoring base_url from ${source}; authenticated traffic uses the origin stored with this machine's credential. Run \`notifai login\` to pair with a different origin.`,
+  )
 }
 
 export function authedClient(deps: CommandDeps, config: CliConfig): { client: ApiClient; baseUrl: string } | null {
@@ -142,9 +173,10 @@ export function authedClient(deps: CommandDeps, config: CliConfig): { client: Ap
     // trace: it returns before any request is made, so without this the log
     // shows an exit code and no cause.
     log(deps).error('cli.error', { kind: 'auth', message: 'not signed in', store: deps.store.describe() })
-    deps.io.err('Not signed in. Run `notifai login` first.')
+    deps.io.err('Not signed in. Run `notifai init`; it will coordinate machine login and device setup.')
     return null
   }
+  diagnoseIgnoredOriginOverride(deps.io, config, credential)
   const baseUrl = resolvedBaseUrl(config, credential)
   return {
     client: makeClient(deps, baseUrl, `Bearer nfm_${credential.machineId}.${credential.secret}`),
@@ -233,7 +265,10 @@ export function reportError(
           'disagree about the contract; check with `notifai doctor`',
       )
     }
-    const recovery = localRecovery(err.recoveryAction, err.details)
+    const recovery =
+      err.code === 'no_active_devices'
+        ? 'next: Run `notifai init` to connect an active Companion App; it will complete machine setup and identify any human-only device step.'
+        : localRecovery(err.recoveryAction, err.details)
     if (recovery !== null) deps.io.err(recovery)
     else if (err.recoveryAction === null && err.nextAction) deps.io.err(`next: ${err.nextAction}`)
     if (err.code === 'auth_required' || err.code === 'machine_revoked') return EXIT.auth