@wrongstack/cli 1.0.4 → 1.0.7

package/dist/{chunk-3I5ZJXM5.js → chunk-XIZZ2EXG.js}

@@ -24,7 +24,7 @@ import {
   sanitizeApiError,
   truncateHqSummary,
   writeInvalidBody
-} from "./chunk-I7V2OYVH.js";
+} from "./chunk-5EA6OTLJ.js";
 import {
   createHqIpAllowlist
 } from "./chunk-Q7E3BPDU.js";
@@ -44,7 +44,7 @@ import {
   hqTokenKey as hqTokenKey2,
   isTokenExpired as isTokenExpired4,
   mintHqCookieSecret as mintHqCookieSecret2,
-  mutateHqAuthFile as mutateHqAuthFile3,
+  mutateHqAuthFile as mutateHqAuthFile4,
   toAlertMessage,
   watchHqAuthFile
 } from "@wrongstack/core/hq";
@@ -135,10 +135,15 @@ function hasTrustedRequestAuthority(req, boundHost, boundPort, trustedPublicOrig
     return false;
   }
 }
-function hasTrustedBrowserOrigin(req, boundHost, boundPort, trustedPublicOrigins = /* @__PURE__ */ new Set(), allowFileOrigin = false) {
+function hasTrustedBrowserOrigin(req, boundHost, boundPort, trustedPublicOrigins = /* @__PURE__ */ new Set(), allowFileOrigin = false, credentialedSurface = false) {
   if (!hasTrustedRequestAuthority(req, boundHost, boundPort, trustedPublicOrigins)) return false;
   const origin = req.headers.origin;
-  if (origin === void 0) return true;
+  if (origin === void 0) {
+    if (!credentialedSurface) {
+      return boundHost !== void 0 && isLoopbackHost(boundHost);
+    }
+    return true;
+  }
   try {
     const parsed = new URL(origin);
     if (parsed.protocol === "file:") return allowFileOrigin;
@@ -222,7 +227,7 @@ function isCookieAuth(auth) {
   return auth !== void 0 && auth.kind === "cookie";
 }
 function hqAuthRequired(mutableAuth, requireBrowserAuth) {
-  return requireBrowserAuth === true || mutableAuth.requireAuthFloor === true || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash !== void 0;
+  return (requireBrowserAuth ?? mutableAuth.requireBrowserAuth) === true || mutableAuth.requireAuthFloor === true || mutableAuth.browserTokens.size > 0 || mutableAuth.passwordHash !== void 0;
 }
 function hqClientAuthRequired(mutableAuth) {
   return mutableAuth.requireAuthFloor === true || mutableAuth.clientTokens.size > 0;
@@ -364,7 +369,8 @@ function createHqAuthState(authFile, dataDir, opts = {}) {
     clientTokens: /* @__PURE__ */ new Set(),
     browserTokenObjs: /* @__PURE__ */ new Map(),
     clientTokenObjs: /* @__PURE__ */ new Map(),
-    alertRules: void 0
+    alertRules: void 0,
+    requireBrowserAuth: opts.requireBrowserAuth
   };
   projectAuthFile(mutableAuth, authFile);
   return {
@@ -727,7 +733,32 @@ async function serveHqStatic(_req, res, urlPath, distDir) {
 }
 
 // src/hq-server/routes/auth/common.ts
-import { isLoopbackHost as isLoopbackHost2 } from "@wrongstack/core/hq";
+import { isLoopbackHost as isLoopbackHost2, mutateHqAuthFile } from "@wrongstack/core/hq";
+import { verifyTotpCounter } from "@wrongstack/core/security";
+function recordVerifyFailure(loginAttempts, clientIp) {
+  const prev = loginAttempts.get(clientIp);
+  const count = (prev?.count ?? 0) + 1;
+  loginAttempts.recordFailure(clientIp);
+  return count;
+}
+async function consumeTotpCode(code, mutableAuth, dataDir, applyAuthFile) {
+  if (!mutableAuth.totpSecret) return "invalid";
+  const matchedCounter = verifyTotpCounter(code, mutableAuth.totpSecret);
+  if (matchedCounter === void 0) return "invalid";
+  if (mutableAuth.totpLastUsedCounter !== void 0 && matchedCounter <= mutableAuth.totpLastUsedCounter) {
+    return "replayed";
+  }
+  mutableAuth.totpLastUsedCounter = matchedCounter;
+  try {
+    const next = await mutateHqAuthFile(dataDir, (current) => ({
+      ...current,
+      totpLastUsedCounter: matchedCounter
+    }));
+    applyAuthFile(next);
+  } catch {
+  }
+  return "ok";
+}
 function isLoopbackRequest(req) {
   const address = req.socket.remoteAddress?.replace(/^::ffff:/, "");
   return address !== void 0 && isLoopbackHost2(address);
@@ -775,7 +806,8 @@ import { randomUUID } from "node:crypto";
 import {
   hashHqPassword,
   mintHqCookieSecret,
-  mutateHqAuthFile,
+  mutateHqAuthFile as mutateHqAuthFile2,
+  hqPasswordNeedsUpgrade,
   verifyHqPassword
 } from "@wrongstack/core/hq";
 
@@ -844,7 +876,7 @@ async function handleApiAuthStatus(req, res, url, mutableAuth, sessions, require
     })
   );
 }
-async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops, sessionCapabilities) {
+async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, secureCookies, trustedProxyHops, dataDir, sessionCapabilities) {
   if (!mutableAuth.passwordHash) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
@@ -895,6 +927,14 @@ async function handleApiLogin(req, res, mutableAuth, sessions, loginAttempts, se
     return;
   }
   const ok = await verifyHqPassword(body.password, mutableAuth.passwordHash);
+  if (ok && hqPasswordNeedsUpgrade(mutableAuth.passwordHash)) {
+    try {
+      const upgraded = await hashHqPassword(body.password);
+      await mutateHqAuthFile2(dataDir, (current) => ({ ...current, passwordHash: upgraded }));
+      mutableAuth.passwordHash = upgraded;
+    } catch {
+    }
+  }
   if (!ok || !mutableAuth.cookieSecret) {
     loginAttempts.recordFailure(clientIp, body.password);
     res.writeHead(401, { "Content-Type": "application/json" });
@@ -953,7 +993,7 @@ async function handleApiLogout(req, res, mutableAuth, sessions, secureCookies) {
   res.writeHead(200, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ loggedIn: false }));
 }
-async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secureCookies, requireBrowserAuth, applyAuthFile) {
+async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secureCookies, requireBrowserAuth, applyAuthFile, loginAttempts, trustedProxyHops) {
   const auth = authenticateBrowserRequest(
     req,
     new URL(req.url ?? "/", "http://localhost"),
@@ -993,21 +1033,43 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
     res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "Invalid JSON body." } }));
     return;
   }
-  const hasAdminCapability = auth !== void 0 && "capabilities" in auth && auth.capabilities?.includes("auth.admin");
-  if (!localOpenBootstrap && mutableAuth.passwordHash !== void 0 && !hasAdminCapability) {
+  if (!localOpenBootstrap && mutableAuth.passwordHash !== void 0) {
+    const clientIp = resolveClientAddress(req, trustedProxyHops);
+    const { blocked, retryAfter } = loginAttempts.checkBlocked(clientIp);
+    if (blocked) {
+      res.writeHead(429, {
+        "Content-Type": "application/json",
+        "Retry-After": String(retryAfter)
+      });
+      res.end(
+        JSON.stringify({
+          error: { code: "RATE_LIMITED", message: "Too many attempts. Try again later." }
+        })
+      );
+      return;
+    }
     const currentPassword = typeof body.currentPassword === "string" ? body.currentPassword : "";
-    if (!currentPassword || !await verifyHqPassword(currentPassword, mutableAuth.passwordHash)) {
+    let confirmed = currentPassword.length > 0 && await verifyHqPassword(currentPassword, mutableAuth.passwordHash);
+    let replayed = false;
+    if (!confirmed && typeof body.code === "string" && mutableAuth.totpSecret) {
+      const outcome = await consumeTotpCode(body.code, mutableAuth, dataDir, applyAuthFile);
+      confirmed = outcome === "ok";
+      replayed = outcome === "replayed";
+    }
+    if (!confirmed) {
+      recordVerifyFailure(loginAttempts, clientIp);
       res.writeHead(403, { "Content-Type": "application/json" });
       res.end(
         JSON.stringify({
           error: {
-            code: "INVALID_CURRENT_PASSWORD",
-            message: "Current password is required to change or remove it."
+            code: replayed ? "TOTP_ALREADY_USED" : "INVALID_CURRENT_PASSWORD",
+            message: replayed ? "That authenticator code has already been used. Wait for the next one." : "Current password or a TOTP code is required to change or remove it."
           }
         })
       );
       return;
     }
+    loginAttempts.delete(clientIp);
   }
   if (req.method === "DELETE") {
     if (requireBrowserAuth && mutableAuth.browserTokens.size === 0) {
@@ -1022,7 +1084,7 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
       );
       return;
     }
-    const next2 = await mutateHqAuthFile(dataDir, (current) => {
+    const next2 = await mutateHqAuthFile2(dataDir, (current) => {
       const updated = { ...current };
       delete updated.passwordHash;
       delete updated.cookieSecret;
@@ -1059,7 +1121,7 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
   }
   const passwordHash = await hashHqPassword(newPassword);
   const cookieSecret = mintHqCookieSecret();
-  const next = await mutateHqAuthFile(dataDir, (current) => ({
+  const next = await mutateHqAuthFile2(dataDir, (current) => ({
     ...current,
     passwordHash,
     cookieSecret
@@ -1083,25 +1145,18 @@ async function handleApiPassword(req, res, mutableAuth, sessions, dataDir, secur
 
 // src/hq-server/routes/auth/totp-routes.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { mutateHqAuthFile as mutateHqAuthFile2, verifyHqPassword as verifyHqPassword2 } from "@wrongstack/core/hq";
+import { mutateHqAuthFile as mutateHqAuthFile3, verifyHqPassword as verifyHqPassword2 } from "@wrongstack/core/hq";
 import {
   buildOtpAuthUri,
   generateRecoveryCodes,
   generateTotpSecret,
   hashRecoveryCode,
   verifyRecoveryCode,
-  verifyTotp,
-  verifyTotpCounter
+  verifyTotp
 } from "@wrongstack/core/security";
 var PENDING_2FA_TTL_MS = 5 * 6e4;
 var recoveryCodeLock = Promise.resolve();
 var MAX_2FA_VERIFY_FAILURES = 5;
-function recordVerifyFailure(loginAttempts, clientIp) {
-  const prev = loginAttempts.get(clientIp);
-  const count = (prev?.count ?? 0) + 1;
-  loginAttempts.recordFailure(clientIp);
-  return count;
-}
 async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, loginAttempts, dataDir, secureCookies, applyAuthFile, trustedProxyHops) {
   if (!mutableAuth.cookieSecret) {
     res.writeHead(503, { "Content-Type": "application/json" });
@@ -1164,9 +1219,9 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       );
       return;
     }
-    const matchedCounter = verifyTotpCounter(body.code, mutableAuth.totpSecret);
-    const replayed = matchedCounter !== void 0 && mutableAuth.totpLastUsedCounter !== void 0 && matchedCounter <= mutableAuth.totpLastUsedCounter;
-    if (matchedCounter === void 0 || replayed) {
+    const outcome = await consumeTotpCode(body.code, mutableAuth, dataDir, applyAuthFile);
+    const replayed = outcome === "replayed";
+    if (outcome !== "ok") {
       if (recordVerifyFailure(loginAttempts, clientIp) >= MAX_2FA_VERIFY_FAILURES) {
         sessions.delete(sessionId);
       }
@@ -1181,15 +1236,6 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       );
       return;
     }
-    mutableAuth.totpLastUsedCounter = matchedCounter;
-    try {
-      const next = await mutateHqAuthFile2(dataDir, (current) => ({
-        ...current,
-        totpLastUsedCounter: matchedCounter
-      }));
-      applyAuthFile(next);
-    } catch {
-    }
     loginAttempts.clearOnSuccess(clientIp);
     sessions.delete(sessionId);
     const fullSessionId = randomUUID2();
@@ -1241,7 +1287,7 @@ async function handleApiLoginVerify(req, res, _url, mutableAuth, sessions, login
       releaseLock = resolve;
     });
     try {
-      const next = await mutateHqAuthFile2(dataDir, (current) => {
+      const next = await mutateHqAuthFile3(dataDir, (current) => {
         const diskHashes = current.totpRecoveryCodes ?? [];
         const idx = diskHashes.indexOf(usedHash);
         if (idx === -1) {
@@ -1311,7 +1357,7 @@ async function handleApiTotpSetup(req, res, mutableAuth, sessions, dataDir, appl
   }
   const secret = generateTotpSecret();
   const uri = buildOtpAuthUri(secret, "HQ");
-  const next = await mutateHqAuthFile2(dataDir, (current) => ({
+  const next = await mutateHqAuthFile3(dataDir, (current) => ({
     ...current,
     totpPendingSecret: secret
   }));
@@ -1362,7 +1408,7 @@ async function handleApiTotpEnable(req, res, mutableAuth, sessions, dataDir, app
   }
   const recoveryCodes = generateRecoveryCodes();
   const recoveryHashes = recoveryCodes.map(hashRecoveryCode);
-  const next = await mutateHqAuthFile2(dataDir, (current) => {
+  const next = await mutateHqAuthFile3(dataDir, (current) => {
     const updated = { ...current };
     updated.totpSecret = pendingSecret;
     delete updated.totpPendingSecret;
@@ -1399,8 +1445,11 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
   if (typeof body.password === "string" && body.password.length > 0 && mutableAuth.passwordHash) {
     confirmed = await verifyHqPassword2(body.password, mutableAuth.passwordHash);
   }
+  let replayed = false;
   if (!confirmed && typeof body.code === "string" && mutableAuth.totpSecret) {
-    confirmed = verifyTotp(body.code, mutableAuth.totpSecret);
+    const outcome = await consumeTotpCode(body.code, mutableAuth, dataDir, applyAuthFile);
+    confirmed = outcome === "ok";
+    replayed = outcome === "replayed";
   }
   if (!confirmed) {
     recordVerifyFailure(loginAttempts, clientIp);
@@ -1408,15 +1457,15 @@ async function handleApiTotpDisable(req, res, mutableAuth, sessions, loginAttemp
     res.end(
       JSON.stringify({
         error: {
-          code: "CONFIRMATION_REQUIRED",
-          message: "Provide the current password or a TOTP code."
+          code: replayed ? "TOTP_ALREADY_USED" : "CONFIRMATION_REQUIRED",
+          message: replayed ? "That authenticator code has already been used. Wait for the next one." : "Provide the current password or a TOTP code."
         }
       })
     );
     return;
   }
   loginAttempts.delete(clientIp);
-  const next = await mutateHqAuthFile2(dataDir, (current) => {
+  const next = await mutateHqAuthFile3(dataDir, (current) => {
     const updated = { ...current };
     delete updated.totpSecret;
     delete updated.totpPendingSecret;
@@ -2069,7 +2118,11 @@ async function authorizeHqCommand(input) {
     // bootstrap exchange, which is the same thing the dashboard does.
     actor: { kind: authMethod === "session" ? "user" : "remote-client", id: enqueuedBy },
     surface: "hq",
-    capability: command.type === "run-command" ? "hq.control.execute" : "hq.control.enqueue",
+    capability: command.type === "run-command" ? "hq.control.execute" : (
+      // Approvals get their own capability string so a policy can allow
+      // steering while still refusing remote approval of tool calls.
+      command.type === "approve" || command.type === "answer-input" ? "hq.control.approve" : "hq.control.enqueue"
+    ),
     subject,
     risk: command.type === "run-command" ? "critical" : "high",
     scope: { projectId: target.projectId },
@@ -2432,6 +2485,34 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
     res.end(JSON.stringify({ error: "unrecognized or malformed command", type: body.type }));
     return;
   }
+  if ((validated.type === "approve" || validated.type === "answer-input") && isCookieAuth(auth) && auth.capabilities !== void 0 && !auth.capabilities.includes("control.approve")) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "forbidden: browser session lacks control.approve capability"
+      })
+    );
+    return;
+  }
+  if ((validated.type === "approve" || validated.type === "answer-input") && isTokenAuth(auth) && auth.capabilities !== void 0 && !auth.capabilities.includes("control.approve")) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "forbidden: token lacks control.approve capability"
+      })
+    );
+    return;
+  }
+  if ((validated.type === "approve" || validated.type === "answer-input") && !target.capabilities.includes("control.approve")) {
+    res.writeHead(409, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "client does not mirror approvals",
+        clientId: body.clientId
+      })
+    );
+    return;
+  }
   if (validated.type === "run-command" && isCookieAuth(auth) && auth.capabilities !== void 0 && !auth.capabilities.includes("control.execute")) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
@@ -2830,7 +2911,11 @@ function createHqRouter(deps) {
         host,
         listeningPort(),
         trustedPublicOrigins,
-        allowFileOrigin
+        allowFileOrigin,
+        // WS-SEC-06: tells the guard whether anything else can authenticate
+        // this request. In open mode a missing Origin is only acceptable on
+        // a loopback bind.
+        hqAuthRequired(mutableAuth, requireBrowserAuth)
       )) {
         res.writeHead(403, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "forbidden: untrusted request origin" }));
@@ -2912,6 +2997,7 @@ function createHqRouter(deps) {
           loginAttempts,
           secureCookies,
           trustedProxyHops,
+          dataDir,
           url.pathname === "/api/mobile/login" ? ["control.enqueue"] : void 0
         );
         return;
@@ -2985,7 +3071,9 @@ function createHqRouter(deps) {
           dataDir,
           secureCookies,
           requireBrowserAuth,
-          applyAuthFile
+          applyAuthFile,
+          loginAttempts,
+          trustedProxyHops
         );
         return;
       }
@@ -3466,6 +3554,7 @@ import { randomUUID as randomUUID5 } from "node:crypto";
 import {
   HQ_PROTOCOL_VERSION as HQ_PROTOCOL_VERSION2,
   parseHqFrame,
+  redactHqEvent as redactHqEvent2,
   resolveHqRedactionPolicy,
   tightenHqRedactionPolicy as tightenHqRedactionPolicy2,
   tokenHasCapability as tokenHasCapability3
@@ -4128,16 +4217,22 @@ function handleClient(ws, clients, browsers, eventLog, auth, snapshotBroadcaster
           sendGuarded(ws, JSON.stringify({ type: "hq.kanban_snapshot", payload: p }));
         }).catch(() => void 0);
       }
-      const event = {
-        id: randomUUID5(),
-        type: "client.hello",
-        schemaVersion: HQ_PROTOCOL_VERSION2,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        clientId: payload.client.clientId,
-        projectId: payload.project.projectId,
-        seq: 0,
-        payload: { client: payload.client, project: payload.project }
-      };
+      const event = redactHqEvent2(
+        {
+          id: randomUUID5(),
+          type: "client.hello",
+          schemaVersion: HQ_PROTOCOL_VERSION2,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          clientId: payload.client.clientId,
+          projectId: payload.project.projectId,
+          seq: 0,
+          payload: { client: payload.client, project: payload.project }
+        },
+        {
+          policy: tightenHqRedactionPolicy2(declaredRedactionPolicy, auth.getOperatorPolicy()),
+          ...payload.project.projectRoot ? { projectRoot: payload.project.projectRoot } : {}
+        }
+      ).value;
       persistEvent(event);
       snapshotBroadcaster.broadcast();
       broadcastEvent(event, browsers);
@@ -4251,7 +4346,10 @@ function handleHqUpgrade(req, socket, head, deps) {
     deps.host,
     deps.listeningPort(),
     deps.trustedPublicOrigins,
-    deps.allowFileOrigin
+    deps.allowFileOrigin,
+    // WS-SEC-06 — see the guard. `/ws/browser` and `/ws/client` are the two
+    // surfaces this branch left uncontrolled in open mode.
+    hqAuthRequired(deps.mutableAuth, deps.requireBrowserAuth)
   )) {
     socket.write(
       "HTTP/1.1 403 Forbidden\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n" + JSON.stringify({
@@ -4396,14 +4494,15 @@ async function startHqServerWithAuth(options, host, port, dataDir, firstRunAuth)
     }
   };
   const authState = createHqAuthState(authFile, dataDir, {
-    onApplied: (live) => reassessExposureFloor(live)
+    onApplied: (live) => reassessExposureFloor(live),
+    requireBrowserAuth: options.requireBrowserAuth
   });
   const { mutableAuth } = authState;
   const loginAttempts = new LoginAttemptStore(dataDir);
   await loginAttempts.load();
   if (!mutableAuth.cookieSecret && mutableAuth.browserTokens.size > 0) {
     const secret = mintHqCookieSecret2();
-    const next = await mutateHqAuthFile3(dataDir, (current) => ({
+    const next = await mutateHqAuthFile4(dataDir, (current) => ({
       ...current,
       cookieSecret: secret
     }));
@@ -4832,4 +4931,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-3I5ZJXM5.js.map
+//# sourceMappingURL=chunk-XIZZ2EXG.js.map