@wrongstack/webui 0.8.6 → 0.9.0

package/dist/server/index.js

@@ -602,7 +602,6 @@ var WorktreeWebSocketHandler = class {
 };
 
 // src/server/index.ts
-var HTML_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' ws: wss:; img-src 'self' data:; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'";
 async function startWebUI(opts = {}) {
   const wsPort = opts.wsPort ?? 3457;
   const wsHost = opts.wsHost ?? "127.0.0.1";
@@ -612,7 +611,7 @@ async function startWebUI(opts = {}) {
   let config = baseConfig;
   let configWriteLock = Promise.resolve();
   console.log("[WebUI] Config loaded:", config.provider ?? "(none)", "/", config.model ?? "(none)");
-  if (!config.provider && config.providers && Object.keys(config.providers).length > 0) {
+  if (!config.provider && config.providers && typeof config.providers === "object" && config.providers !== null && !Array.isArray(config.providers) && Object.keys(config.providers).length > 0) {
     const firstKey = Object.keys(config.providers)[0];
     config = patchConfig(config, { provider: firstKey });
     console.log("[WebUI] No active provider \u2014 auto-selected:", firstKey);
@@ -903,11 +902,12 @@ async function startWebUI(opts = {}) {
   const RATE_LIMIT_MESSAGES = 60;
   const RATE_LIMIT_WINDOW_MS = 6e4;
   const rateLimits = /* @__PURE__ */ new Map();
-  function checkRateLimit(ws) {
+  function checkRateLimit(ws, client) {
     const now = Date.now();
-    const limit = rateLimits.get(ws);
+    const key = client.sessionId ?? String(ws);
+    const limit = rateLimits.get(key);
     if (!limit || now > limit.resetAt) {
-      rateLimits.set(ws, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });
+      rateLimits.set(key, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });
       return true;
     }
     if (limit.count >= RATE_LIMIT_MESSAGES) return false;
@@ -1036,7 +1036,7 @@ async function startWebUI(opts = {}) {
     autoPhaseHandler.addClient(ws);
     worktreeHandler.addClient(ws);
     ws.on("message", async (data) => {
-      if (!checkRateLimit(ws)) {
+      if (!checkRateLimit(ws, client)) {
         send(ws, {
           type: "error",
           payload: {
@@ -1047,15 +1047,24 @@ async function startWebUI(opts = {}) {
         return;
       }
       try {
-        const msg = JSON.parse(data.toString());
-        await handleMessage(ws, client, msg);
+        const rawObj = JSON.parse(data.toString());
+        if (typeof rawObj === "object" && rawObj !== null) {
+          const obj = rawObj;
+          if ("__proto__" in obj || "constructor" in obj || "prototype" in obj) {
+            send(ws, { type: "error", payload: { phase: "parse", message: "Invalid message object" } });
+          } else {
+            await handleMessage(ws, client, rawObj);
+          }
+        } else {
+          await handleMessage(ws, client, rawObj);
+        }
       } catch (err) {
         console.error("[WebUI] Failed to parse message", err);
       }
     });
     ws.on("close", () => {
       clients.delete(ws);
-      rateLimits.delete(ws);
+      rateLimits.delete(String(ws));
       console.log("[WebUI] Client disconnected, total:", clients.size);
       if (pendingConfirms.size > 0) {
         for (const [id, resolve2] of pendingConfirms) {
@@ -2049,7 +2058,10 @@ async function startWebUI(opts = {}) {
       res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
       if (ext === ".html") {
         res.setHeader("Cache-Control", "no-cache");
-        res.setHeader("Content-Security-Policy", HTML_CSP);
+        res.setHeader(
+          "Content-Security-Policy",
+          `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' ws://127.0.0.1:${wsPort} wss://127.0.0.1:${wsPort} ws://[::1]:${wsPort} wss://[::1]:${wsPort}; img-src 'self' data:; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'`
+        );
       }
       const fileContent = await fs2.readFile(resolvedPath);
       res.writeHead(200);
@@ -2065,7 +2077,7 @@ async function startWebUI(opts = {}) {
             "Referrer-Policy": "strict-origin-when-cross-origin",
             // SPA fallback previously shipped no CSP — apply the same policy as
             // the direct .html branch so deep-linked routes aren't unprotected.
-            "Content-Security-Policy": HTML_CSP
+            "Content-Security-Policy": `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' ws://127.0.0.1:${wsPort} wss://127.0.0.1:${wsPort} ws://[::1]:${wsPort} wss://[::1]:${wsPort}; img-src 'self' data:; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'`
           });
           res.end(fileContent);
         } catch {