arena-bridge 0.7.1 → 0.7.4

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to this project are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/) and the project uses
 [Semantic Versioning](https://semver.org/).
 
+## 0.7.4
+
+### Fixed
+- Approvals over HTTP work again: `POST /approvals/<id>` now answers with the decision instead
+  of an internal error, the local token is accepted by the API, and the agent token is refused —
+  an agent can no longer approve its own dangerous action.
+- The same rule now applies to the hub mode.
+
+## 0.7.3
+
+### Fixed
+- `mac_scroll` speaks the current Peekaboo grammar: the removed `--ticks` option was replaced
+  with `--amount`, and the tool also accepts `amount` as an argument.
+
+## 0.7.2
+
+### Fixed
+- The audit log masks credentials: a Telegram bot token, a GitHub, npm or PyPI token in a
+  command or an argument is written as `***`, so the log cannot become a secret store the
+  agent may read.
+
 ## 0.7.1
 
 ### Fixed

package/README.md

@@ -12,7 +12,7 @@
   <img src="https://img.shields.io/badge/license-MIT-blue.svg?style=flat-square" alt="license">
   <img src="https://img.shields.io/badge/node-%3E%3D18-green.svg?style=flat-square" alt="node">
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen.svg?style=flat-square" alt="dependencies">
-  <img src="https://img.shields.io/badge/tests-147%20passed-brightgreen.svg?style=flat-square" alt="tests">
+  <img src="https://img.shields.io/badge/tests-149%20passed-brightgreen.svg?style=flat-square" alt="tests">
 </p>
 
 <p align="center">
@@ -258,6 +258,33 @@ arena-bridge telegram inbox
 
 ---
 
+## Нативное приложение для macOS
+
+Окно, в котором всё видно и всё управляется: статус, пуск/стоп, подтверждения, журнал.
+
+```bash
+git clone https://github.com/vernikr/arena-bridge.git
+cd arena-bridge/macos/ArenaBridge
+./build.sh                                   # → dist/Arena Bridge.app
+cp -R "dist/Arena Bridge.app" /Applications/
+```
+
+Нужен только Swift из Xcode Command Line Tools (`xcode-select --install`), Xcode целиком не
+требуется. Собирается под текущую архитектуру: `ARCH=x86_64` для Intel, `ARCH=arm64` для
+Apple Silicon.
+
+| Блок в окне | Что делает |
+| --- | --- |
+| Статус | запущен/остановлен, версия, режим, число инструментов, публичный адрес, Telegram |
+| Управление | «Запустить» / «Остановить» (служба `ai.arena.bridge`) и «Настроить…» |
+| Подтверждения | ожидающие запросы агента с кнопками «Разрешить» / «Отклонить» |
+| Журнал | последние записи, фильтр по инструменту, «Сохранить…» в файл |
+
+«Настроить…» собирает конфиг, службу и запуск одной кнопкой: туннель (ngrok/cloudflared),
+зарезервированный домен, authtoken, папки для агента, Telegram (токен бота и chat id).
+
+---
+
 ## Доверенное окно: работать без подтверждений
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arena-bridge",
-  "version": "0.7.1",
+  "version": "0.7.4",
   "description": "Give a cloud AI agent (Arena.ai Agent Mode, Claude, Cursor, ...) controlled access to your own machine over HTTP/MCP: files, shell, Chrome and the macOS desktop, with an approval gate, trust windows and an audit log.",
   "type": "module",
   "bin": {

package/src/audit.mjs

@@ -11,11 +11,35 @@ export function auditPath() {
   return path.join(configDir(), 'audit.log');
 }
 
+const SECRETS = [
+  /(?<!\d)\d{6,12}:[A-Za-z0-9_-]{25,}/g, // telegram bot tokens
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, // github tokens
+  /\bnpm_[A-Za-z0-9]{20,}\b/g, // npm tokens
+  /\bpypi-[A-Za-z0-9_-]{20,}\b/g, // pypi tokens
+  /\bsk-[A-Za-z0-9]{20,}\b/g, // api keys
+];
+
+/** Mask anything that looks like a credential, so the log never becomes a secret store. */
+export function scrub(value) {
+  if (typeof value === 'string') {
+    let out = value;
+    for (const re of SECRETS) out = out.replace(re, '***');
+    return out;
+  }
+  if (Array.isArray(value)) return value.map(scrub);
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = scrub(v);
+    return out;
+  }
+  return value;
+}
+
 export function audit(entry) {
   try {
     const dir = configDir();
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const rec = { ts: new Date().toISOString(), ...entry };
+    const rec = { ts: new Date().toISOString(), ...scrub(entry) };
     fs.appendFileSync(auditPath(), JSON.stringify(rec) + '\n', { mode: 0o600 });
   } catch {
     /* auditing must never break the request */

package/src/direct.mjs

@@ -52,7 +52,7 @@ export function createDirectServer(cfg, engine) {
           ok: true,
           mode: 'direct',
           device: cfg.device,
-          version: '0.7.1',
+          version: '0.7.4',
           uptime_sec: Math.round(process.uptime()),
         });
       }
@@ -118,10 +118,20 @@ export function createDirectServer(cfg, engine) {
 
       const approveMatch = /^\/approvals\/([\w-]+)$/.exec(p);
       if (req.method === 'POST' && approveMatch) {
+        // settling a request is a local-only privilege: the agent token must not self-approve
+        const expected = loadConfig().localToken;
+        const presented = bearer(req);
+        if (!expected || !presented || !safeEqual(presented, expected)) {
+          return sendJson(res, 403, {
+            ok: false,
+            error: 'forbidden',
+            reason: 'approvals require the local token — run "arena-bridge approve <id>" on the machine',
+          });
+        }
         const body = await readJson(req, 64 * 1024);
         const decision = body.decision === 'deny' ? 'deny' : 'approve';
         const res2 = decide(approveMatch[1], decision, 'api');
-        return sendJson(res2.ok ? 200 : 400, res2);
+        return sendJson(res, res2.ok ? 200 : 400, res2);
       }
 
       if (req.method === 'POST' && p === '/exec') {

package/src/http.mjs

@@ -72,6 +72,8 @@ export function bearer(req) {
 
 export function isAuthorized(req, cfg) {
   const token = bearer(req);
-  if (!token || !cfg.token) return false;
-  return safeEqual(token, cfg.token);
+  if (!token) return false;
+  if (cfg.token && safeEqual(token, cfg.token)) return true;
+  // the local token is for the machine owner: approvals and trust
+  return !!(cfg.localToken && safeEqual(token, cfg.localToken));
 }

package/src/hub.mjs

@@ -1,6 +1,6 @@
 import http from 'node:http';
 import crypto from 'node:crypto';
-import { sendJson, sendText, readJson, readBody, isAuthorized, safeEqual } from './http.mjs';
+import { sendJson, sendText, readJson, readBody, isAuthorized, bearer, safeEqual } from './http.mjs';
 import { handleMcp } from './mcp.mjs';
 import { buildPrompt } from './prompt.mjs';
 import { toolCatalog } from './engine.mjs';
@@ -90,7 +90,7 @@ export function createHubServer(cfg) {
         return sendJson(res, 200, {
           ok: true,
           mode: 'hub',
-          version: '0.7.1',
+          version: '0.7.4',
           devices: [...devices.keys()],
         });
       }
@@ -158,10 +158,20 @@ export function createHubServer(cfg) {
 
       const approveMatch = /^\/approvals\/([\w-]+)$/.exec(p);
       if (req.method === 'POST' && approveMatch) {
+        // settling a request is a local-only privilege: the agent token must not self-approve
+        const expected = loadConfig().localToken;
+        const presented = bearer(req);
+        if (!expected || !presented || !safeEqual(presented, expected)) {
+          return sendJson(res, 403, {
+            ok: false,
+            error: 'forbidden',
+            reason: 'approvals require the local token — run "arena-bridge approve <id>" on the machine',
+          });
+        }
         const body = await readJson(req, 64 * 1024);
         const decision = body.decision === 'deny' ? 'deny' : 'approve';
         const r = decide(approveMatch[1], decision, 'api');
-        return sendJson(r.ok ? 200 : 400, r);
+        return sendJson(res, r.ok ? 200 : 400, r);
       }
 
       if (req.method === 'POST' && p === '/exec') {

package/src/mac.mjs

@@ -423,6 +423,7 @@ export function macTools(cfg = {}) {
         {
           direction: { type: 'string', description: 'up or down' },
           ticks: { type: 'number', description: 'how many steps, default 3' },
+          amount: { type: 'number', description: 'how many steps to scroll (same as ticks)' },
           on: { type: 'string', description: 'element id from mac_see' },
           app: { type: 'string' },
           window_id: { type: 'string' },
@@ -439,7 +440,7 @@ export function macTools(cfg = {}) {
         const res = await runVariants(
           p.bin,
           [
-            ['scroll', '--direction', dir, '--ticks', String(args.ticks || 3), ...on, ...flags],
+            ['scroll', '--direction', dir, '--amount', String(args.amount ?? args.ticks ?? 3), ...on, ...flags],
             ['scroll', '--direction', dir, ...on, ...flags],
           ],
           { timeout: 30 },

package/src/mcp.mjs

@@ -48,7 +48,7 @@ export async function handleMcp(req, res, ctx) {
           mcpResponse(id, {
             protocolVersion: PROTOCOL_VERSION,
             capabilities: { tools: { listChanged: false } },
-            serverInfo: { name: 'arena-bridge', version: '0.7.1' },
+            serverInfo: { name: 'arena-bridge', version: '0.7.4' },
             instructions:
               'Tools operate the user\'s own machine. Dangerous operations may return ' +
               'PROTECTED and require a local human approval.',