@yemi33/minions 0.1.1157 → 0.1.1159

package/CHANGELOG.md

@@ -1,5 +1,115 @@
 # Changelog
 
+## 0.1.1159 (2026-04-18)
+
+### Features
+- Header gate — Origin allowlist, Content-Type enforcement, security response headers (#1336)
+- Header gate — Origin allowlist, Content-Type enforcement, security response headers (#1327)
+- escapeHtml helper, hotspot XSS migration, regression gate (#1323)
+- Prototype pollution guard in readBody (SEC-13) (#1300)
+- redact ADO tokens and JWTs from engine/log.json writes (#1297)
+- SEC-02 — replace curl shell-out in ado.js with adoFetch (#1296)
+- validate project name and path on POST /api/projects/add (SEC-04, SEC-05) (#1298)
+- seed realActivityMap at spawn time, stamp pid in live-output (#1200)
+
+### Fixes
+- ado merge-commit mismatch preserves prior buildStatus (closes #1233) (#1326)
+- scheduler substitutes {{date}} in title and description (#1275)
+-  prevent archived plans from re-triggering via orphaned .backup restore
+- pinned context optimistic save (closes #1295) (#1316)
+-  re-check throttle state per-PR iteration to avoid stale fixThrottled
+- preserve buildErrorLog through transient states, persist poll time (#1273)
+-  auto-fetch PR title on link-pr (closes #1283) (#1299)
+- scheduler double-fire within same cron minute (#1277)
+-  gate auto-fix dispatch on throttle state to prevent stale-data spurious fixes
+- preserve buildErrorLog through transient build states (#1232) (#1274)
+- annotate fast-exit empty-output failures with diagnostic hint (#1276)
+- invalidate PRD cache on pr-links.json change + guard aggregate PRs (#1220) (#1272)
+- pass --add-dir for minions + ~/.claude to agents (#1271)
+- preserve VERDICT marker by tail-slicing agent output (#1234) (#1270)
+- PRD info cache staleness and aggregate PR bleed-through (#1222)
+-  avoid no-op work item writes
+-  resilient claude binary resolution + surface spawn errors
+-  resolve native claude.exe from npm wrapper on Windows
+- cap temp-agent creation at maxConcurrent per tick (#1219)
+-  reassign pending items from unspawned temp agents to idle named agents (#1204) (#1212)
+
+### Other
+- refactor: hoist fixThrottled before PR loop and drop underscore prefix
+- docs(skill): add substitute-scheduler-template-vars (#1278)
+- Clarify PR poll labels
+- Prevent modal opens on text selection
+- refactor: clarify settings page section structure and PR polling dependencies
+- refactor: extract _probeClaudePackage helper, use shared.log for spawn errors
+- Make work item descriptions scrollable
+- Use PAT for publish merges
+- test(queries): add unit tests for invalidateDispatchCache/getInbox/getAgentCharter (#1214)
+- test(shared): add unit tests for truncateTextBytes/tailTextBytes/execSilent/trackReviewMetric/parseCanonicalPrId (#1215)
+- Fix publish workflow merge
+- chore: raise default meeting round timeout
+- Harden prompt context handling
+- Harden loop watch conversion
+- Add watches sidebar activity badge
+- test(cli): add unit tests for handleCommand, start, stop, kill, spawn (#1191)
+- chore: untrack pipeline files — local config only
+- restore: recover daily-arch-improvement and weekly-dead-code-cleanup pipelines
+- Harden CC stream resilience
+
+## 0.1.1158 (2026-04-18)
+
+### Features
+- Header gate — Origin allowlist, Content-Type enforcement, security response headers (#1336)
+- Header gate — Origin allowlist, Content-Type enforcement, security response headers (#1327)
+- escapeHtml helper, hotspot XSS migration, regression gate (#1323)
+- Prototype pollution guard in readBody (SEC-13) (#1300)
+- redact ADO tokens and JWTs from engine/log.json writes (#1297)
+- SEC-02 — replace curl shell-out in ado.js with adoFetch (#1296)
+- validate project name and path on POST /api/projects/add (SEC-04, SEC-05) (#1298)
+- seed realActivityMap at spawn time, stamp pid in live-output (#1200)
+
+### Fixes
+- ado merge-commit mismatch preserves prior buildStatus (closes #1233) (#1326)
+- scheduler substitutes {{date}} in title and description (#1275)
+-  prevent archived plans from re-triggering via orphaned .backup restore
+- pinned context optimistic save (closes #1295) (#1316)
+-  re-check throttle state per-PR iteration to avoid stale fixThrottled
+- preserve buildErrorLog through transient states, persist poll time (#1273)
+-  auto-fetch PR title on link-pr (closes #1283) (#1299)
+- scheduler double-fire within same cron minute (#1277)
+-  gate auto-fix dispatch on throttle state to prevent stale-data spurious fixes
+- preserve buildErrorLog through transient build states (#1232) (#1274)
+- annotate fast-exit empty-output failures with diagnostic hint (#1276)
+- invalidate PRD cache on pr-links.json change + guard aggregate PRs (#1220) (#1272)
+- pass --add-dir for minions + ~/.claude to agents (#1271)
+- preserve VERDICT marker by tail-slicing agent output (#1234) (#1270)
+- PRD info cache staleness and aggregate PR bleed-through (#1222)
+-  avoid no-op work item writes
+-  resilient claude binary resolution + surface spawn errors
+-  resolve native claude.exe from npm wrapper on Windows
+- cap temp-agent creation at maxConcurrent per tick (#1219)
+-  reassign pending items from unspawned temp agents to idle named agents (#1204) (#1212)
+
+### Other
+- refactor: hoist fixThrottled before PR loop and drop underscore prefix
+- docs(skill): add substitute-scheduler-template-vars (#1278)
+- Clarify PR poll labels
+- Prevent modal opens on text selection
+- refactor: clarify settings page section structure and PR polling dependencies
+- refactor: extract _probeClaudePackage helper, use shared.log for spawn errors
+- Make work item descriptions scrollable
+- Use PAT for publish merges
+- test(queries): add unit tests for invalidateDispatchCache/getInbox/getAgentCharter (#1214)
+- test(shared): add unit tests for truncateTextBytes/tailTextBytes/execSilent/trackReviewMetric/parseCanonicalPrId (#1215)
+- Fix publish workflow merge
+- chore: raise default meeting round timeout
+- Harden prompt context handling
+- Harden loop watch conversion
+- Add watches sidebar activity badge
+- test(cli): add unit tests for handleCommand, start, stop, kill, spawn (#1191)
+- chore: untrack pipeline files — local config only
+- restore: recover daily-arch-improvement and weekly-dead-code-cleanup pipelines
+- Harden CC stream resilience
+
 ## 0.1.1157 (2026-04-18)
 
 ### Features

package/dashboard.js

@@ -1323,7 +1323,10 @@ function checkRateLimit(key, maxPerMinute) {
 
 function jsonReply(res, code, data, req) {
   res.setHeader('Content-Type', 'application/json');
-  res.setHeader('Access-Control-Allow-Origin', '*');
+  // Access-Control-Allow-Origin is set ONCE by the server dispatcher prelude:
+  // `*` for GET/HEAD (read-only), never for mutating responses (Origin gate
+  // already blocked cross-origin POSTs). Setting it here would reopen the
+  // cross-origin write path.
   res.statusCode = code;
   const json = JSON.stringify(data);
   const ae = req && req.headers && req.headers['accept-encoding'] || '';
@@ -1443,17 +1446,95 @@ function restartEngine() {
 
 // -- Server --
 
+// Mutating HTTP methods that require Origin and Content-Type gating.
+// GET/HEAD/OPTIONS are treated as read-only/preflight and bypass these checks.
+const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
 const server = http.createServer(async (req, res) => {
-  // CORS preflight
+  // ── Security headers (applied to every response) ──────────────────────────
+  // Baseline CSP + clickjacking/mime/referrer protections. The dashboard HTML
+  // entry-point later overrides CSP for its inline <script>/<style> blocks;
+  // all API (JSON, text, SSE) responses inherit the strict CSP from here.
+  const _secHeaders = shared.buildSecurityHeaders();
+  for (const [k, v] of Object.entries(_secHeaders)) {
+    try { res.setHeader(k, v); } catch { /* headers may already be sent in rare error paths */ }
+  }
+
+  // ── Origin gate (mutating + OPTIONS preflight) ────────────────────────────
+  // Defense-in-depth against CSRF / DNS-rebinding: even though the dashboard
+  // binds to 127.0.0.1, a malicious page can coerce a user's browser to POST
+  // to localhost. We reject any mutating request whose Origin (or Referer, if
+  // Origin is absent) is not in the local allowlist. When both headers are
+  // absent (curl, CLI tooling, Node http.request without Origin) we allow the
+  // request to preserve existing local automation.
+  const _rawOrigin = req.headers['origin'];
+  const _rawReferer = req.headers['referer'];
+  const _isMutating = MUTATING_METHODS.has(req.method);
+
+  function _originGateReject(reason) {
+    console.warn(`[origin-gate] reject ${req.method} ${req.url} origin=${_rawOrigin || _rawReferer || '(none)'} reason=${reason}`);
+    res.statusCode = 403;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({ error: 'Origin not allowed' }));
+  }
+
+  // CORS preflight — echo validated origin; reject disallowed origins outright.
   if (req.method === 'OPTIONS') {
-    res.setHeader('Access-Control-Allow-Origin', '*');
-    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+    if (_rawOrigin) {
+      if (!shared.isAllowedOrigin(_rawOrigin)) { _originGateReject('preflight-origin'); return; }
+      res.setHeader('Access-Control-Allow-Origin', _rawOrigin);
+      res.setHeader('Vary', 'Origin');
+    }
+    // Note: when Origin is absent (non-browser preflight), no ACAO is echoed —
+    // that's fine, only browsers care about ACAO and they always send Origin.
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS');
     res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
     res.statusCode = 204;
     res.end();
     return;
   }
 
+  // Mutating requests: enforce Origin allowlist (Origin first, Referer fallback).
+  if (_isMutating) {
+    if (_rawOrigin) {
+      if (!shared.isAllowedOrigin(_rawOrigin)) { _originGateReject('origin'); return; }
+    } else if (_rawReferer) {
+      if (!shared.isAllowedOrigin(_rawReferer)) { _originGateReject('referer'); return; }
+    }
+    // Neither Origin nor Referer present → legacy tooling (curl, Node.js) is allowed.
+
+    // Content-Type enforcement: require application/json on mutating requests.
+    // readBody() always expects JSON. Rejecting anything other than
+    // application/json closes the entire CSRF "simple request" loophole
+    // (text/plain, application/x-www-form-urlencoded, multipart/form-data are
+    // all cross-origin-postable without a preflight). DELETE with an empty
+    // body (Content-Length: 0) is exempt — it carries no payload to parse.
+    const ct = String(req.headers['content-type'] || '').toLowerCase();
+    const clen = parseInt(req.headers['content-length'] || '0', 10) || 0;
+    const hasBody = clen > 0 || req.headers['transfer-encoding'];
+    if (hasBody && !ct.startsWith('application/json')) {
+      res.statusCode = 415;
+      res.setHeader('Content-Type', 'application/json');
+      res.end(JSON.stringify({ error: 'Content-Type must be application/json' }));
+      return;
+    }
+    // Empty-body mutating request (e.g. DELETE /api/cc-sessions/:id) with
+    // no Content-Type is allowed — no body, no CSRF-friendly payload.
+    if (!hasBody && ct && !ct.startsWith('application/json')) {
+      res.statusCode = 415;
+      res.setHeader('Content-Type', 'application/json');
+      res.end(JSON.stringify({ error: 'Content-Type must be application/json' }));
+      return;
+    }
+  }
+
+  // GET: permit cross-origin reads for external monitoring tools (curl, uptime
+  // checks). Mutating responses deliberately do NOT set ACAO — cross-origin
+  // browsers cannot use them anyway (Origin check blocks that path).
+  if (req.method === 'GET' || req.method === 'HEAD') {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+  }
+
   // ── Route Handler Functions ───────────────────────────────────────────────
 
   async function handlePlansTriggerVerify(req, res) {
@@ -2289,6 +2370,20 @@ const server = http.createServer(async (req, res) => {
   }
 
   async function handleAgentLiveStream(req, res, match) {
+    // SSE Origin gate — must run BEFORE res.writeHead(200, ...) so we can
+    // still return a 403 with a normal status line. Once we upgrade to SSE
+    // the client has no way to distinguish a rejection from a dropped stream.
+    // GETs normally skip the Origin check, but SSE streams are long-lived and
+    // warrant the same cross-origin guard as mutating endpoints.
+    const _origin = req.headers['origin'];
+    if (_origin && !shared.isAllowedOrigin(_origin)) {
+      console.warn(`[sse-origin-gate] reject GET ${req.url} origin=${_origin}`);
+      res.statusCode = 403;
+      res.setHeader('Content-Type', 'application/json');
+      res.end(JSON.stringify({ error: 'Origin not allowed' }));
+      return;
+    }
+
     const agentId = match[1];
     const agentDir = path.join(MINIONS_DIR, 'agents', agentId);
     const liveLogPath = path.join(agentDir, 'live-output.log');
@@ -4021,6 +4116,18 @@ What would you like to discuss or change? When you're happy, say "approve" and I
   }
 
   async function handleCommandCenterStream(req, res) {
+    // SSE Origin gate (belt-and-suspenders: the top-level dispatcher has
+    // already rejected disallowed origins on POST, but validate again here
+    // before res.writeHead(200, text/event-stream) so any future refactor
+    // that moves the route can't accidentally bypass the check).
+    const _origin = req.headers['origin'];
+    if (_origin && !shared.isAllowedOrigin(_origin)) {
+      console.warn(`[sse-origin-gate] reject POST /api/command-center/stream origin=${_origin}`);
+      res.statusCode = 403;
+      res.setHeader('Content-Type', 'application/json');
+      res.end(JSON.stringify({ error: 'Origin not allowed' }));
+      return;
+    }
     if (checkRateLimit('command-center', 10)) { res.statusCode = 429; res.end('Rate limited'); return; }
     let tabId;
     let _ccStreamAbort = null;
@@ -5366,6 +5473,20 @@ What would you like to discuss or change? When you're happy, say "approve" and I
   res.setHeader('Content-Type', 'text/html; charset=utf-8');
   res.setHeader('ETag', HTML_ETAG);
   res.setHeader('Cache-Control', 'no-cache'); // revalidate each time, but use 304 if unchanged
+  // The SPA ships as a single self-contained HTML: inline <script> block,
+  // inline <style> block, and many inline onclick= handlers on page
+  // fragments. Strict `script-src 'self'` would break every button. We
+  // relax the default CSP ONLY for the dashboard HTML entry-point — the
+  // strict CSP still applies to all /api/* responses (verified by tests).
+  // data: in img-src permits the inline SVG favicon (<link rel="icon" href="data:...">).
+  res.setHeader(
+    'Content-Security-Policy',
+    "default-src 'self'; " +
+    "script-src 'self' 'unsafe-inline'; " +
+    "style-src 'self' 'unsafe-inline'; " +
+    "img-src 'self' data:; " +
+    "connect-src 'self'"
+  );
   if (req.headers['if-none-match'] === HTML_ETAG) {
     res.statusCode = 304;
     res.end();

package/engine/shared.js

@@ -1131,6 +1131,56 @@ function sanitizeBranch(name) {
   return String(name).replace(/[^a-zA-Z0-9._\-\/]/g, '-').slice(0, 200);
 }
 
+// ── HTTP Origin Allowlist & Security Headers ─────────────────────────────────
+// Pure helpers used by dashboard.js to gate mutating requests against an
+// explicit allowlist of local origins and to attach uniform security response
+// headers. Extracted here so they're unit-testable without the HTTP server.
+
+// Allowed origin (scheme + host) — port-agnostic. Dashboard always binds to
+// 127.0.0.1:7331 locally; browser tabs may arrive as localhost, 127.0.0.1, or
+// IPv6 [::1] depending on how the user opened the page.
+// WHATWG URL keeps IPv6 brackets in `hostname`, so we compare against the
+// bracketed form `[::1]`. We also accept the bare form `::1` defensively.
+const _ALLOWED_ORIGIN_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+const _ALLOWED_ORIGIN_SCHEMES = new Set(['http:']);
+
+/**
+ * Returns true if the origin-like header value (either an `Origin` header value
+ * such as `http://localhost:7331` or a full `Referer` URL) belongs to the local
+ * dashboard allowlist. Port-agnostic. Returns false for null/undefined/empty,
+ * the literal string `'null'` (sandboxed iframes, data: URIs), malformed URLs,
+ * non-http schemes, and any host not in the allowlist.
+ * @param {string|null|undefined} origin
+ * @returns {boolean}
+ */
+function isAllowedOrigin(origin) {
+  if (!origin || typeof origin !== 'string') return false;
+  const trimmed = origin.trim();
+  if (!trimmed || trimmed === 'null') return false;
+  let parsed;
+  try { parsed = new URL(trimmed); } catch { return false; }
+  if (!parsed.hostname) return false;
+  if (!_ALLOWED_ORIGIN_SCHEMES.has(parsed.protocol)) return false;
+  return _ALLOWED_ORIGIN_HOSTS.has(parsed.hostname);
+}
+
+/**
+ * Returns the baseline set of security response headers to apply on every HTTP
+ * response from the dashboard. Values match OWASP defaults for a same-origin
+ * SPA served from 127.0.0.1. The HTML entry-point response intentionally
+ * overrides CSP to allow its inline `<script>` / `<style>` blocks; API (JSON,
+ * SSE) responses inherit the strict CSP returned here.
+ * @returns {{[key:string]: string}}
+ */
+function buildSecurityHeaders() {
+  return {
+    'Content-Security-Policy': "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'",
+    'X-Frame-Options': 'DENY',
+    'X-Content-Type-Options': 'nosniff',
+    'Referrer-Policy': 'same-origin',
+  };
+}
+
 // ── Project Name / Path Validation (SEC-04 / SEC-05) ─────────────────────────
 // Enforced at API boundaries (e.g. POST /api/projects/add). Callers that skip
 // these validators leak caller-controlled strings into worktree paths, config
@@ -1809,6 +1859,8 @@ module.exports = {
   getAdoOrgBase,
   sanitizePath,
   sanitizeBranch,
+  isAllowedOrigin,
+  buildSecurityHeaders,
   hasDangerousKey,
   validateProjectName,
   validateProjectPath,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.1157",
+  "version": "0.1.1159",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"