biofirewall 1.0.0 → 1.0.1

package/index.js

@@ -8,4 +8,4 @@ module.exports = BioFirewall;
 module.exports.solve = challenge.solve;
 
 // Export middleware directly if preferred
-module.exports.middleware = (options) => new BioFirewall(options).middleware();
+module.exports.middleware = (options) => new BioFirewall(options).middleware();

package/lib/biofirewall.js

@@ -1,19 +1,27 @@
+const crypto = require('crypto');
 const rules = require('./rules');
-const challenge = require('./challenge');
 
+/**
+ * BioFirewall - Proof of Work Challenge for Silicon Verification
+ * Ensures only agents (silicon) can access, not browsers (carbon)
+ */
 class BioFirewall {
     constructor(options = {}) {
         this.options = {
             blockBrowsers: true,
             enforceChallenge: true,
-            challengeDifficulty: 3, // Number of leading zeros required
+            challengeDifficulty: options.difficulty || options.challengeDifficulty || 4,
+            sessionTimeout: 60000,
             ...options
         };
     }
 
+    /**
+     * Express middleware
+     */
     middleware() {
         return (req, res, next) => {
-            // 1. Passive Filtering (The Silicon Curtain)
+            // 1. Passive Filtering (Check User-Agent)
             if (this.options.blockBrowsers) {
                 if (rules.isHuman(req)) {
                     return res.status(406).type('application/json').json({
@@ -24,37 +32,43 @@ class BioFirewall {
                 }
             }
 
-            // 2. Active Filtering (The Computational Toll)
+            // 2. Active Filtering (PoW Challenge)
             if (this.options.enforceChallenge) {
-                const solution = req.headers['x-bio-solution'];
+                // Get proof headers (both formats supported for compatibility)
+                const nonce = req.headers['x-bio-solution'] || req.headers['x-proof-nonce'];
+                const seed = req.headers['x-bio-challenge-seed'] || req.headers['x-proof-seed'];
 
-                if (!solution) {
-                    return this.sendChallenge(res);
+                // If both are present, validate
+                if (nonce && seed) {
+                    const isValid = this._validateProof(seed, nonce);
+                    
+                    if (isValid) {
+                        res.set('X-Silicon-Verified', 'true');
+                        return next();
+                    } else {
+                        return res.status(403).json({
+                            error: 'INVALID_PROOF',
+                            message: 'Proof of Work validation failed',
+                            challenge: this._generateChallenge()
+                        });
+                    }
                 }
 
-                // Verify specific challenge solution
-                // In a real/stateless app, we might sign the seed. 
-                // For this demo, we verify the solution satisfies the generic work requirement.
-                // To be fully secure, the 'seed' should be verified as one we issued recently.
-                const originalSeed = req.headers['x-bio-challenge-seed']; // Client passes back the seed they solved for
-
-                if (!originalSeed || !challenge.verify(originalSeed, solution, this.options.challengeDifficulty)) {
-                    return res.status(403).json({
-                        error: "INVALID_COMPUTATION",
-                        message: "Proof of work failed or insufficient difficulty."
-                    });
-                }
+                // No proof, send challenge
+                return this.sendChallenge(res);
             }
 
             next();
         };
     }
 
+    /**
+     * Send a PoW challenge to the client
+     */
     sendChallenge(res) {
-        const seed = challenge.generateSeed();
+        const seed = crypto.randomBytes(16).toString('hex');
         const difficulty = this.options.challengeDifficulty;
 
-        // 428 Precondition Required
         res.status(428).set({
             'X-Bio-Challenge-Algo': 'sha256',
             'X-Bio-Challenge-Difficulty': difficulty,
@@ -70,6 +84,28 @@ class BioFirewall {
             }
         });
     }
+
+    /**
+     * Generate a new challenge
+     */
+    _generateChallenge() {
+        return {
+            algo: 'sha256',
+            seed: crypto.randomBytes(16).toString('hex'),
+            difficulty: this.options.challengeDifficulty
+        };
+    }
+
+    /**
+     * Validate a nonce against a seed
+     */
+    _validateProof(seed, nonce) {
+        const candidate = seed + nonce;
+        const hash = crypto.createHash('sha256').update(candidate).digest('hex');
+        const target = '0'.repeat(this.options.challengeDifficulty);
+        
+        return hash.startsWith(target);
+    }
 }
 
-module.exports = BioFirewall;
+module.exports = BioFirewall;

package/lib/challenge.js

@@ -1,28 +1,31 @@
-const crypto = require('crypto');
-
 module.exports = {
-    generateSeed: () => {
-        return crypto.randomBytes(16).toString('hex');
-    },
+    isHuman: (req) => {
+        const userAgent = req.get('User-Agent') || '';
+        const accept = req.get('Accept') || '';
+
+        // Rule 1: Reject common Browser User-Agents
+        const browserKeywords = ['Mozilla', 'Chrome', 'Safari', 'Edge', 'Firefox', 'AppleWebKit'];
+        const isBrowserAgent = browserKeywords.some(keyword => userAgent.includes(keyword));
+
+        // Rule 2: Humans usually ask for HTML
+        const asksForHtml = accept.includes('text/html');
 
-    verify: (seed, nonce, difficulty) => {
-        const hash = crypto.createHash('sha256').update(seed + nonce).digest('hex');
-        const prefix = '0'.repeat(difficulty);
-        return hash.startsWith(prefix);
-    },
+        // Rule 3: Missing User-Agent is suspicious for humans? 
+        // Actually bots often have no UA or proper UA. 
+        // Humans almost ALWAYS have a sophisticated UA string.
 
-    // Helper for bots (exported so bots can use this alg)
-    solve: (seed, difficulty) => {
-        const prefix = '0'.repeat(difficulty);
-        let nonce = 0;
-        while (true) {
-            const hash = crypto.createHash('sha256').update(seed + String(nonce)).digest('hex');
-            if (hash.startsWith(prefix)) {
-                return String(nonce);
+        if (isBrowserAgent) {
+            // Allow override if they explicitly identify as a bot in UA? 
+            // For this specific 'anti-human' firewall, if it looks like a browser, kill it.
+            if (!userAgent.toLowerCase().includes('bot') && !userAgent.toLowerCase().includes('openclaw')) {
+                return true;
             }
-            nonce++;
-            // Safety break for testing to avoid infinite loop if difficulty is crazy high
-            if (nonce > 10000000) return null;
         }
+
+        if (asksForHtml) {
+            return true;
+        }
+
+        return false;
     }
-};
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "biofirewall",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Anti-Human Firewall: Block browsers, allow bots via Proof-of-Work to verify silicon heritage.",
   "main": "index.js",
   "scripts": {
@@ -20,7 +20,6 @@
   "author": "OpenClaw Community",
   "license": "MIT",
   "dependencies": {
-    "axios": "^1.13.4",
-    "express": "^4.21.2"
+    "axios": "^1.13.4"
   }
-}
+}