@wakeshift/openclaw 1.4.38 → 1.4.40

package/dist/plugin.js

@@ -32,7 +32,7 @@ import { acceptable, BeaconError, beaconIn, findBeacon, jwkKey, mcpServer, mcpTo
 import { Conversation, Ledger } from "./deliveries.js";
 import { agentOf } from "./hooks.js";
 import { linkKey, PINS_UNREADABLE } from "./store.js";
-import { Transport } from "./transport.js";
+import { checkStreamLink, Transport } from "./transport.js";
 import { CLIENT_HEADER, clientHeader } from "./version.js";
 /** The connected note's start (harnesses.Connected): agents look for it. */
 export const CONNECTED = "Wakeshift: connected";
@@ -86,16 +86,7 @@ export function stripBeacon(v) {
  * ws for http), as the plugin trusts only links from the pinned Wakeshift.
  */
 export function linkOnIssuer(link, issuer) {
-    let l, i;
-    try {
-        l = new URL(link);
-        i = new URL(issuer);
-    }
-    catch {
-        return false;
-    }
-    const scheme = { "wss:": "https:", "https:": "https:", "ws:": "http:", "http:": "http:" };
-    return !!l.host && scheme[l.protocol] !== undefined && scheme[l.protocol] === i.protocol && l.host.toLowerCase() === i.host.toLowerCase();
+    return checkStreamLink(link, issuer) === undefined;
 }
 /** How often delivery records are pruned while the gateway runs. */
 export const PRUNE_EVERY = 3600 * 1000;
@@ -300,8 +291,11 @@ export class Wakeshift {
                 return NOTE_TAKEN; // the link it had stays
             return noteFailed(e.message);
         }
-        if (!linkOnIssuer(link, this.o.issuer))
-            return noteFailed("Wakeshift gave a stream link on another host");
+        const refused = checkStreamLink(link, this.o.issuer);
+        if (refused) {
+            this.o.host.log.warn(`wakeshift (${sessionKey}): ${refused}`);
+            return noteFailed(refused);
+        }
         // A new stream ID: what the link it replaces brought isn't this one's to acknowledge.
         const saved = { conversation, sessionKey, agentId: call.agentId ?? "", link, issuer: this.o.issuer, app: claims.app, stream: randomBytes(8).toString("hex") };
         this.o.store.saveLink(saved);
@@ -478,6 +472,7 @@ export class Wakeshift {
         t = new Transport({
             ...this.o.stream,
             link: l.link,
+            issuer: this.o.issuer,
             fetch: this.f,
             log,
             receive: (ds) => c.receive(ds, stream),

package/dist/transport.js

@@ -12,6 +12,7 @@
 // including another 403 or 404 (a router during a deploy, a firewall),
 // reconnects with backoff. A connection that ends at once without a
 // delivery counts as a failure for the backoff.
+import { isIP } from "node:net";
 import { CLIENT_HEADER, clientHeader } from "./version.js";
 /** The longest SSE line, and the largest poll answer, read; a longer line is skipped. */
 export const MAX_LINE = 1 << 20;
@@ -31,6 +32,59 @@ export function parseLink(link) {
         return undefined;
     return { base: `${scheme}//${u.host}`, token };
 }
+/** localhost, or a loopback IP address (127.0.0.0/8, ::1), as Hermes's plugin reads it (ipaddress). */
+function loopback(hostname) {
+    const h = hostname.replace(/^\[|\]$/g, "");
+    if (h === "localhost")
+        return true;
+    if (isIP(h) === 4)
+        return h.startsWith("127.");
+    return isIP(h) === 6 && /^(0{0,4}:){7}0{0,3}1$|^::1$/.test(h);
+}
+/**
+ * Undefined if a stream link may be dialed: wss or https on the issuer's
+ * host exactly (its port included), or ws or http on it where the issuer
+ * is itself http on loopback (development and tests). Otherwise why not,
+ * naming only the link's scheme and host (never its token or a user name):
+ * another host, a lookalike or subdomain, userinfo, another port, an IP
+ * literal for a named issuer, ws or http to an https issuer.
+ */
+export function checkStreamLink(link, issuer) {
+    let l;
+    try {
+        l = new URL(link);
+    }
+    catch {
+        return "refused a stream link: it isn't a stream link";
+    }
+    const scheme = l.protocol.replace(/:$/, "");
+    if (!l.host)
+        return "refused a stream link: it isn't a stream link";
+    if (l.username || l.password)
+        return `refused a stream link to ${scheme}://…@${l.host}: it carries a user name or password`;
+    const where = `${scheme}://${l.host}`;
+    const secure = { wss: true, https: true, ws: false, http: false }[scheme];
+    if (secure === undefined)
+        return `refused a stream link to ${where}: it isn't wss or https`;
+    let i;
+    try {
+        i = new URL(issuer);
+    }
+    catch {
+        return `refused a stream link to ${where}: no Wakeshift is trusted here`;
+    }
+    if (!i.host || i.username || i.password)
+        return `refused a stream link to ${where}: no Wakeshift is trusted here`;
+    if (l.host.toLowerCase() === i.host.toLowerCase()) {
+        if (i.protocol === "https:" && secure)
+            return undefined;
+        if (i.protocol === "http:" && !secure && loopback(i.hostname))
+            return undefined;
+    }
+    return `refused a stream link to ${where}: Wakeshift's stream links go only to ${i.protocol}//${i.host}`;
+}
+class Refused extends Error {
+}
 export function sameOrigin(a, b) {
     const x = parseLink(a), y = parseLink(b);
     return !!x && !!y && x.base === y.base;
@@ -126,6 +180,11 @@ export class Transport {
     async ack(ids) {
         if (ids.length === 0 || ids.length > 100)
             throw new Error("ack: 1 to 100 IDs");
+        const why = checkStreamLink(this.link, this.o.issuer);
+        if (why) {
+            this.log(why);
+            return 401;
+        }
         const p = parseLink(this.link);
         if (!p)
             return 401;
@@ -187,6 +246,13 @@ export class Transport {
             catch (e) {
                 if (this.stopped)
                     break;
+                if (e instanceof Refused) {
+                    // Never dialed: its token goes nowhere. The link is kept, in case
+                    // its Wakeshift is pinned again.
+                    this.log(e.message);
+                    result = { why: "refused" };
+                    break;
+                }
                 if (e instanceof Gone) {
                     result = { why: "gone", reason: e.reason };
                     break;
@@ -221,6 +287,9 @@ export class Transport {
         this.resolveDone(result);
     }
     parts() {
+        const why = checkStreamLink(this.link, this.o.issuer);
+        if (why)
+            throw new Refused(why);
         const p = parseLink(this.link);
         if (!p)
             throw new Gone("not a stream link");
@@ -246,7 +315,7 @@ export class Transport {
         if (typeof next !== "string" || !next)
             return;
         const p = parseLink(next);
-        if (!p || !sameOrigin(next, this.link))
+        if (!p || !sameOrigin(next, this.link) || checkStreamLink(next, this.o.issuer))
             return;
         const cur = new URL(this.link);
         const link = `${cur.protocol}//${cur.host}/v1/stream?link=${encodeURIComponent(p.token)}`;

package/dist/version.js

@@ -3,7 +3,7 @@
 // ask the user to update. "dev" here; `npm run pack` stamps the build's
 // version into dist/version.js (scripts/stamp-version.mjs, from
 // WAKESHIFT_VERSION).
-export const VERSION = "2026.11.08.2255+bb5da54";
+export const VERSION = "2026.11.09.2152+03d15b5";
 export const CLIENT_HEADER = "X-Wakeshift-Connector";
 /** X-Wakeshift-Connector's value: wakeshift-openclaw/<version> openclaw. */
 export function clientHeader(version = VERSION) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wakeshift/openclaw",
-  "version": "1.4.38",
+  "version": "1.4.40",
   "description": "Wakeshift for OpenClaw: wakes an OpenClaw session when an app it watches through Wakeshift sends something.",
   "license": "Apache-2.0",
   "repository": {