buninu 0.4.2 → 0.4.5

package/apps/bunx/bunx.js

@@ -144,7 +144,11 @@ if (needsInstall(bunInstallRoot, target, version, pkgName)) {
   const install = Bun.spawnSync(installArgs, {
     stdio: ["inherit", "inherit", "inherit"],
   });
-  if (install.exitCode !== 0) process.exit(install.exitCode ?? 1);
+  
+  // Don't check exit code so even if
+  // bun install killed by SIGSYS @issue #39060
+  // bunx still runs with actually existing bin
+  //if (install.exitCode !== 0) process.exit(install.exitCode ?? 1);
 }
 
 if (!fs.existsSync(target)) {

package/apps/jsgotty/gotty.js

@@ -800,6 +800,28 @@ function basicAuthAuthorized(req, credential) {
   return payload === credential;
 }
 
+// Match gorilla/websocket's default policy used by upstream GoTTY: non-browser
+// clients without Origin are accepted, while browser connections must come
+// from the same host. --ws-origin intentionally replaces this default check.
+function webSocketOriginAllowed(req, originMatcher = null) {
+  const origin = req.headers.origin;
+
+  if (originMatcher) {
+    return originMatcher.test(origin || "");
+  }
+  if (!origin) {
+    return true;
+  }
+
+  try {
+    const originHost = new URL(origin).host;
+    const requestHost = req.headers.host || "";
+    return originHost !== "" && originHost.toLowerCase() === requestHost.toLowerCase();
+  } catch {
+    return false;
+  }
+}
+
 function sendBasicAuthRequired(res) {
   res.writeHead(401, {
     "WWW-Authenticate": 'Basic realm="GoTTY"',
@@ -2940,12 +2962,9 @@ function createServerRuntime(command, argv, options) {
       return;
     }
 
-    if (originMatcher) {
-      const origin = req.headers.origin || "";
-      if (!originMatcher.test(origin)) {
-        socket.destroy();
-        return;
-      }
+    if (!webSocketOriginAllowed(req, originMatcher)) {
+      socket.destroy();
+      return;
     }
 
     if (options.once && acceptedOnce && !options.reconnect) {
@@ -3295,6 +3314,7 @@ async function bootstrap() {
 
 module.exports.CursorStateTracker = CursorStateTracker;
 module.exports.KittyGraphicsParser = KittyGraphicsParser;
+module.exports.webSocketOriginAllowed = webSocketOriginAllowed;
 
 if (require.main === module) {
   if (KITTY_TRACE) {

package/apps/jsgotty/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "jsgotty",
-  "version": "1.1.5",
+  "version": "1.1.11",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "jsgotty",
-      "version": "1.1.5",
+      "version": "1.1.11",
       "dependencies": {
         "node-addon-api": "^7.1.1",
         "ws": "^8.18.3"

package/apps/jsgotty/package.json

@@ -1,7 +1,8 @@
 {
   "name": "jsgotty",
-  "version": "1.1.9",
+  "version": "1.1.11",
   "description": "Share your terminal as a web application: A JavaScript rewrite of GoTTY",
+  "license": "MIT",
   "bin": {
     "jsgotty": "./gotty.js"
   },

package/apps/jsgotty/tests/websocket-origin.test.js

@@ -0,0 +1,54 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const { webSocketOriginAllowed } = require("../gotty.js");
+
+function request(host, origin) {
+  return {
+    headers: {
+      host,
+      ...(origin === undefined ? {} : { origin }),
+    },
+  };
+}
+
+test("WebSocket permits clients without Origin", () => {
+  assert.equal(webSocketOriginAllowed(request("127.0.0.1:8080")), true);
+});
+
+test("WebSocket permits same-origin browsers", () => {
+  assert.equal(
+    webSocketOriginAllowed(request("127.0.0.1:8080", "http://127.0.0.1:8080")),
+    true,
+  );
+  assert.equal(
+    webSocketOriginAllowed(request("Example.COM:8080", "https://example.com:8080")),
+    true,
+  );
+});
+
+test("WebSocket rejects cross-origin and malformed browser origins", () => {
+  assert.equal(
+    webSocketOriginAllowed(request("127.0.0.1:8080", "https://attacker.example")),
+    false,
+  );
+  assert.equal(webSocketOriginAllowed(request("127.0.0.1:8080", "null")), false);
+  assert.equal(webSocketOriginAllowed(request("127.0.0.1:8080", "not a URL")), false);
+});
+
+test("--ws-origin regex replaces the same-origin default", () => {
+  const matcher = /^https:\/\/trusted\.example$/;
+  assert.equal(
+    webSocketOriginAllowed(
+      request("127.0.0.1:8080", "https://trusted.example"),
+      matcher,
+    ),
+    true,
+  );
+  assert.equal(
+    webSocketOriginAllowed(
+      request("127.0.0.1:8080", "http://127.0.0.1:8080"),
+      matcher,
+    ),
+    false,
+  );
+});

package/apps/jsmdcui/README.md

@@ -867,6 +867,20 @@ Ctrl-E  cdp 9000 --public
 The default bind address is `127.0.0.1` and the default port is `9222`.
 Use `--public` or `--address=0.0.0.0` only on a trusted network.
 
+Like Chromium, jsmdcui rejects WebSocket connections carrying an `Origin`
+header by default. This prevents ordinary web pages from controlling the TUI.
+Non-browser automation clients, which omit `Origin`, continue to work. To
+explicitly allow a trusted browser origin, use a comma-separated allowlist:
+
+```sh
+bun src/index.js --remote-debugging-port=9222 \
+  --remote-allow-origins=http://localhost:8000 demos/maze.md
+```
+
+`--remote-allow-origins=*` disables this protection and should only be used in
+a trusted environment. CDP can evaluate JavaScript and has the same authority
+as the jsmdcui process.
+
 Once CDP is running, control the TUI with `Bun.WebView`. For more info, enter
 jsmdcui and use `Ctrl-E` or `€` → `help cdp`.
 

package/apps/jsmdcui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsmdcui",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "Markdown as a Common UI for Terminals and Web Browsers",
   "type": "module",
   "main": "./src/index.js",

package/apps/jsmdcui/runtime/help/cdp.md

@@ -18,6 +18,12 @@
 //   From the command line (Chrome-style):
 //     bunmicro --remote-debugging-port=9222 file.txt
 //     bunmicro --remote-debugging-port=9222 --remote-debugging-address=0.0.0.0 file.txt
+//     bunmicro --remote-debugging-port=9222 --remote-allow-origins=http://localhost:8000 file.txt
+//
+//   Browser WebSocket origins are rejected by default, as in Chromium.
+//   --remote-allow-origins accepts a comma-separated allowlist; `*` allows all
+//   origins and disables this protection. Non-browser clients omit Origin and
+//   continue to work without this flag.
 //
 //   Once running, status bar shows:  CDP@<port> server running
 //   Running cdp again shows:         CDP@<port> already running

package/apps/jsmdcui/runtime/help/help.md

@@ -867,6 +867,20 @@ Ctrl-E  cdp 9000 --public
 The default bind address is `127.0.0.1` and the default port is `9222`.
 Use `--public` or `--address=0.0.0.0` only on a trusted network.
 
+Like Chromium, jsmdcui rejects WebSocket connections carrying an `Origin`
+header by default. This prevents ordinary web pages from controlling the TUI.
+Non-browser automation clients, which omit `Origin`, continue to work. To
+explicitly allow a trusted browser origin, use a comma-separated allowlist:
+
+```sh
+bun src/index.js --remote-debugging-port=9222 \
+  --remote-allow-origins=http://localhost:8000 demos/maze.md
+```
+
+`--remote-allow-origins=*` disables this protection and should only be used in
+a trusted environment. CDP can evaluate JavaScript and has the same authority
+as the jsmdcui process.
+
 Once CDP is running, control the TUI with `Bun.WebView`. For more info, enter
 jsmdcui and use `Ctrl-E` or `€` → `help cdp`.
 

package/apps/jsmdcui/runtime/jsplugins/cdp/cdp-server.js

@@ -1,13 +1,22 @@
 const CDP_DEFAULT_PORT = 9222;
 const CDP_PROTOCOL_VERSION = "1.3";
 const CDP_BROWSER_ID = "cdp-server";
+const CDP_BROWSER_PATH = `/devtools/browser/${CDP_BROWSER_ID}`;
 
 let serverLogEnabled = 0//true;
 function serverLog(...args) {
-  if (serverLogEnabled) console.log(...args);
+  if ( process.env.JSMDCUI_CDP_DEBUG ||
+       serverLogEnabled )
+  {
+    console.log(...args);
+  }
 }
 function serverError(...args) {
-  if (serverLogEnabled) console.error(...args);
+  if ( process.env.JSMDCUI_CDP_DEBUG ||
+       serverLogEnabled )
+  {
+    console.error(...args);
+  }
 }
 
 export class CdpServer {
@@ -21,9 +30,10 @@ export class CdpServer {
     return new CdpServer(context);
   }
 
-  listen(port = CDP_DEFAULT_PORT, hostname = "127.0.0.1") {
+  listen(port = CDP_DEFAULT_PORT, hostname = "127.0.0.1", options = {}) {
     const context = this.#context;
     const state = createCdpState();
+    const remoteAllowOrigins = parseAllowedOrigins(options.remoteAllowOrigins);
 
     const server = Bun.serve({
       port,
@@ -31,25 +41,65 @@ export class CdpServer {
       fetch(req, server) {
         const url = new URL(req.url);
         const pathname = url.pathname.replace(/\/+$/, "") || "/";
+
+        const origin = req.headers.get("origin");
+        const respond = async (response) => {
+          const text = await response.clone().text();
+          serverLog(
+            `[CdpServer] HTTP ${req.method} ${pathname} -> ${response.status}`,
+            text,
+          );
+          return response;
+        };
+
         serverLog(`[CdpServer] HTTP ${req.method} ${pathname}`);
-        if (server.upgrade(req)) return;
+
+        serverLog(`[CdpServer] Origin ${origin}`);
+
+        if (!isSafeHostHeader(req.headers.get("host"))) {
+          return respond(new Response("Host header must be an IP address or localhost", {
+            status: 500,
+          }));
+        }
+
+        if (req.headers.get("upgrade")?.toLowerCase() === "websocket") {
+          if (!isOriginAllowed(origin, remoteAllowOrigins)) {
+            return respond(new Response(
+              `Rejected an incoming WebSocket connection from the ${origin} origin. `
+                + `Use --remote-allow-origins=${origin} to allow it, or `
+                + "--remote-allow-origins=* to allow all origins.",
+              { status: 403 },
+            ));
+          }
+          if (pathname !== CDP_BROWSER_PATH) {
+            return respond(new Response("Not Found", { status: 404 }));
+          }
+          if (server.upgrade(req)) {
+            serverLog(
+              `[CdpServer] HTTP ${req.method} ${pathname} -> 101`,
+              "Switching Protocols",
+            );
+            return;
+          }
+          return respond(new Response("WebSocket upgrade failed", { status: 500 }));
+        }
 
         const host = req.headers.get("host") ?? `127.0.0.1:${port}`;
         const webSocketDebuggerUrl = `ws://${host}/devtools/browser/${CDP_BROWSER_ID}`;
 
         if (pathname === "/json/version") {
-          return jsonResponse({
+          return respond(jsonResponse({
             Browser: "CdpServer/1.0",
             "Protocol-Version": CDP_PROTOCOL_VERSION,
             "User-Agent": "CdpServer/1.0",
             "V8-Version": Bun.version,
             "WebKit-Version": "537.36",
             webSocketDebuggerUrl,
-          });
+          }));
         }
 
         if (pathname === "/json" || pathname === "/json/list") {
-          return jsonResponse(
+          return respond(jsonResponse(
             [...state.targets.values()].map((target) => ({
               id: target.targetId,
               type: target.type,
@@ -57,14 +107,14 @@ export class CdpServer {
               url: target.url,
               webSocketDebuggerUrl,
             }))
-          );
+          ));
         }
 
-        return jsonResponse({
+        return respond(jsonResponse({
           server: "CdpServer",
           port,
           webSocketDebuggerUrl,
-        });
+        }));
       },
       websocket: {
         open(ws) {
@@ -73,6 +123,11 @@ export class CdpServer {
         async message(ws, raw) {
           let id;
           let sessionId;
+          const send = (message) => {
+            const text = JSON.stringify(message);
+            serverLog("[CdpServer] WebSocket response", text);
+            ws.send(text);
+          };
           try {
             const text = typeof raw === "string" ? raw : new TextDecoder().decode(raw);
             const msg = JSON.parse(text);
@@ -82,13 +137,12 @@ export class CdpServer {
             serverLog(`[CdpServer] -> ${method}`, params ?? "");
 
             const emit = (eventMethod, eventParams) => {
-              ws.send(
-                JSON.stringify({
-                  method: eventMethod,
-                  params: eventParams,
-                  ...(sessionId ? { sessionId } : {}),
-                })
-              );
+              serverLog(`[CdpServer] <- ${eventMethod} EVENT`, eventParams ?? {});
+              send({
+                method: eventMethod,
+                params: eventParams,
+                ...(sessionId ? { sessionId } : {}),
+              });
             };
             const result = await dispatch(
               context,
@@ -99,25 +153,22 @@ export class CdpServer {
               emit
             );
             serverLog(`[CdpServer] <- ${method} OK`, result ?? "");
-            ws.send(
-              JSON.stringify({
-                id,
-                result: result ?? {},
-                ...(sessionId ? { sessionId } : {}),
-              })
-            );
+            send({
+              id,
+              result: result ?? {},
+              ...(sessionId ? { sessionId } : {}),
+            });
           } catch (err) {
             serverError(`[CdpServer] <- ERROR ${err.message}`);
-            ws.send(
-              JSON.stringify({
-                id,
-                error: {
-                  code: -32601,
-                  message: err.message,
-                },
-                ...(sessionId ? { sessionId } : {}),
-              })
-            );
+            serverLog("[CdpServer] <- ERROR", { id, sessionId, message: err.message });
+            send({
+              id,
+              error: {
+                code: -32601,
+                message: err.message,
+              },
+              ...(sessionId ? { sessionId } : {}),
+            });
           }
         },
         close(ws) {
@@ -131,6 +182,33 @@ export class CdpServer {
   }
 }
 
+export function parseAllowedOrigins(value) {
+  const origins = Array.isArray(value) ? value : String(value ?? "").split(",");
+  return new Set(origins.map((origin) => origin.trim().toLowerCase()).filter(Boolean));
+}
+
+export function isOriginAllowed(origin, allowedOrigins = new Set()) {
+  if (origin == null) return true;
+  const normalized = origin.toLowerCase();
+  return allowedOrigins.has("*") || allowedOrigins.has(normalized);
+}
+
+export function isSafeHostHeader(header) {
+  if (!header) return true;
+  try {
+    let hostname = new URL(`http://${header}`).hostname.toLowerCase();
+    if (hostname.startsWith("[") && hostname.endsWith("]")) {
+      hostname = hostname.slice(1, -1);
+    }
+    if (hostname === "localhost" || hostname.endsWith(".localhost")) return true;
+    if (hostname.includes(":")) return /^[0-9a-f:.]+$/i.test(hostname);
+    return /^\d{1,3}(?:\.\d{1,3}){3}$/.test(hostname)
+      && hostname.split(".").every((part) => Number(part) <= 255);
+  } catch {
+    return false;
+  }
+}
+
 function jsonResponse(value, status = 200) {
   return new Response(JSON.stringify(value), {
     status,

package/apps/jsmdcui/runtime/jsplugins/cdp/cdp.js

@@ -65,6 +65,8 @@ micro.on("init", () => {
   micro.MakeCommand("cdp", async (bp, args) =>
   {
     const addrFlag = args.find(a => a.startsWith("--address="))?.slice("--address=".length);
+    const allowOrigins = args.find(a => a.startsWith("--remote-allow-origins="))
+      ?.slice("--remote-allow-origins=".length);
     const isPublic = args.includes("--public");
     const port = parseInt(args.find(a => /^\d+$/.test(a))) || parseInt(Bun.env.CDP_PORT) || 9222;
     const hostname = addrFlag ?? (isPublic ? "0.0.0.0" : "127.0.0.1");
@@ -123,7 +125,7 @@ micro.on("init", () => {
       micro.cdpPort = port;
       CdpServer
         .create(micro.cdpContext)
-        .listen(port, hostname);
+        .listen(port, hostname, { remoteAllowOrigins: allowOrigins });
 
       const addr = isPublic ? `0.0.0.0:${port}` : `127.0.0.1:${port}`;
       micro.TermMessage(`CDP@${addr} server running 伺服器啟動了`)

package/apps/jsmdcui/src/index.js

@@ -1119,6 +1119,7 @@ function parseArgs(argv) {
     cdpMaze: false,
     cdpPort: 0,
     cdpAddress: "",
+    cdpAllowOrigins: "",
     kittyMode: kittyModeFromEnvironment(process.env.JSMDCUI_KITTY_MODE),
     settings: new Map(),
   };
@@ -1197,6 +1198,10 @@ function parseArgs(argv) {
       flags.cdpAddress = arg.slice("--remote-debugging-address=".length);
     } else if (arg === "--remote-debugging-address") {
       flags.cdpAddress = argv[++i] ?? "";
+    } else if (arg.startsWith("--remote-allow-origins=")) {
+      flags.cdpAllowOrigins = arg.slice("--remote-allow-origins=".length);
+    } else if (arg === "--remote-allow-origins") {
+      flags.cdpAllowOrigins = argv[++i] ?? "";
     } else if (arg.startsWith("-") && arg.length > 1 && i + 1 < argv.length) {
       flags.settings.set(arg.slice(1), argv[++i]);
     } else {
@@ -1306,6 +1311,8 @@ CDP(Chrome DevTools Protocol):
       Start CDP (Chrome DevTools Protocol) server on PORT at launch
   --remote-debugging-address=ADDRESS
       Bind CDP server to ADDRESS (default: 127.0.0.1); use 0.0.0.0 for all interfaces
+  --remote-allow-origins=ORIGINS
+      Allow comma-separated browser WebSocket origins; no browser origins are allowed by default
 
 Information:
   --help, -h, -help
@@ -9072,6 +9079,9 @@ async function main() {
   if (flags.cdpPort) {
     const cdpArgs = [flags.cdpPort];
     if (flags.cdpAddress) cdpArgs.push(`--address=${flags.cdpAddress}`);
+    if (flags.cdpAllowOrigins) {
+      cdpArgs.push(`--remote-allow-origins=${flags.cdpAllowOrigins}`);
+    }
     await app.handleCommand(`cdp ${cdpArgs.join(" ")}`);
   }
 

package/apps/jsmdcui/tests/cdp-security.test.js

@@ -0,0 +1,32 @@
+import { describe, expect, test } from "bun:test";
+import {
+  isOriginAllowed,
+  isSafeHostHeader,
+  parseAllowedOrigins,
+} from "../runtime/jsplugins/cdp/cdp-server.js";
+
+describe("Chromium-compatible CDP request checks", () => {
+  test("rejects browser origins by default but permits clients without Origin", () => {
+    expect(isOriginAllowed(null)).toBe(true);
+    expect(isOriginAllowed(undefined)).toBe(true);
+    expect(isOriginAllowed("http://localhost:8000")).toBe(false);
+    expect(isOriginAllowed("null")).toBe(false);
+  });
+
+  test("allows only explicitly configured origins or wildcard", () => {
+    const exact = parseAllowedOrigins("http://localhost:8000, HTTPS://EXAMPLE.COM");
+    expect(isOriginAllowed("http://localhost:8000", exact)).toBe(true);
+    expect(isOriginAllowed("https://example.com", exact)).toBe(true);
+    expect(isOriginAllowed("http://127.0.0.1:8000", exact)).toBe(false);
+    expect(isOriginAllowed("https://evil.example", parseAllowedOrigins("*"))).toBe(true);
+  });
+
+  test("accepts IP and localhost Host headers but rejects DNS names", () => {
+    expect(isSafeHostHeader("127.0.0.1:9222")).toBe(true);
+    expect(isSafeHostHeader("[::1]:9222")).toBe(true);
+    expect(isSafeHostHeader("localhost:9222")).toBe(true);
+    expect(isSafeHostHeader("devtools.localhost:9222")).toBe(true);
+    expect(isSafeHostHeader("attacker.example:9222")).toBe(false);
+    expect(isSafeHostHeader("127.0.0.999:9222")).toBe(false);
+  });
+});

package/apps/jsmdcui/tests/cdp-websocket-test.html

@@ -0,0 +1,46 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>jsmdcui CDP WebSocket test</title>
+
+<button id="test">Try CDP connection</button>
+<pre id="status">Ready.</pre>
+
+<script>
+  const status = document.querySelector("#status");
+  const endpoint = "ws://127.0.0.1:9222/devtools/browser/cdp-server";
+
+  function log(message) {
+    status.textContent += `\n${message}`;
+  }
+
+  function testCdp() {
+    status.textContent = `Connecting to ${endpoint}`;
+    const socket = new WebSocket(endpoint);
+
+    socket.addEventListener("open", () => {
+      log("WebSocket connected. Sending Input.insertText...");
+
+      socket.send(JSON.stringify({
+        id: 1,
+        method: "Input.insertText",
+        params: { text: "hello from web page" },
+      }));
+    });
+
+    socket.addEventListener("message", (event) => {
+      log(`CDP response: ${event.data}`);
+      socket.close();
+    });
+
+    socket.addEventListener("error", () => {
+      log("WebSocket error or browser blocked the connection.");
+    });
+
+    socket.addEventListener("close", (event) => {
+      log(`WebSocket closed (code ${event.code}).`);
+    });
+  }
+
+  document.querySelector("#test").addEventListener("click", testCdp);
+  testCdp();
+</script>

package/apps/jsmdcui/tests/demo.test.js

@@ -26,6 +26,7 @@ test("--help describes the non-overwriting demo behavior", () => {
   expect(output.match(/Open it in the TUI and write 5 generated files beside it/g)?.length).toBe(2);
   expect(output).not.toContain("Alias for --demo-image-processor");
   expect(output).toContain("--cdp-maze");
+  expect(output).toContain("--remote-allow-origins=ORIGINS");
 });
 
 test("--demo-list lists root and automatically discovered demos", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buninu",
-  "version": "0.4.2",
+  "version": "0.4.5",
   "description": "Buninu is a portable, self-bootstrapping Unix-like userspace built on Bun that runs across operating systems",
   "type": "module",
   "main": "./bin/init.js",
@@ -25,7 +25,8 @@
     },
     "exitAfterCmd": false,
     "backToConsole": true,
-    "xdgDataHome": null
+    "xdgDataHome": null,
+    "hideExtraKeys": false
   },
   "scripts": {
     "start": "bun ./apps/jsgotty/gotty.js --reconnect -r -w --webgl -a 127.0.0.1",