claude-code-memory-explorer 0.9.0 → 0.10.0

package/lib/net-guard.js

@@ -0,0 +1,267 @@
+'use strict';
+
+// Network boundary for a local-only dev server.
+//
+// Binding loopback is necessary but not sufficient. Three distinct attackers:
+//
+//   * LAN peer — http://192.168.1.42:3541/api/... The loopback bind stops this
+//     outright; the handshake never completes off-box.
+//   * DNS rebinding — the victim loads evil.com, the attacker re-resolves that
+//     name to 127.0.0.1, and the page fetches http://evil.com:3541/api/...
+//     The page's origin *is* evil.com:3541, so the request is same-origin and
+//     CORS never fires; the connection is to loopback, so the bind is satisfied.
+//     The only thing that differs from a legitimate request is the Host header,
+//     which script cannot forge. A Host allowlist is the entire defense.
+//   * Plain CSRF — evil.com POSTs straight at 127.0.0.1:3541. Host is a real
+//     allowlisted value, so hostGuard passes it; this needs a separate Origin /
+//     Sec-Fetch-Site check on state-changing methods.
+//
+// There is no authentication. Exposing this to a network means trusting everyone
+// on it with the user's Claude Code history.
+//
+// CANONICAL COPY: scripts/security-lib/net-guard.js in the claude-code-hub repo.
+// Run scripts/sync-security-lib.sh after editing.
+
+const LOOPBACK_HOSTS = new Set([
+  'localhost',
+  '127.0.0.1',
+  '::1',
+  '0:0:0:0:0:0:0:1',
+  '::ffff:127.0.0.1',
+]);
+
+// Hoisted: parseHostHeader runs on every request, and neither the regex nor the
+// predicate depends on the argument.
+const PORT_RE = /^[0-9]{1,5}$/;
+// The port is validated but not compared — the listen(0) fallbacks make the real
+// port dynamic, so only the host is allowlisted.
+const validPort = (p) => PORT_RE.test(p) && Number(p) >= 1 && Number(p) <= 65535;
+
+function isLoopbackAddress(host) {
+  if (!host) return false;
+  const h = String(host).toLowerCase();
+  return LOOPBACK_HOSTS.has(h) || h.startsWith('127.');
+}
+
+// Hand-parsed rather than via new URL(), which is far more permissive than we
+// want here and happily accepts things no real client sends. Returns the bare
+// hostname, lowercased, or null if the header is malformed.
+//
+// The port is deliberately ignored: ports are dynamic in these apps because of
+// the listen(0) fallback when the default is busy, so pinning one would break
+// the fallback path.
+function parseHostHeader(value) {
+  if (typeof value !== 'string') return null;
+  const raw = value.trim();
+  if (!raw || raw.length > 259) return null;
+
+  // Reject whitespace and control characters. Written as a code-point scan rather
+  // than a character class so it cannot be misread — a stray range in a regex
+  // here would silently reject legitimate hostnames containing a dash.
+  for (let i = 0; i < raw.length; i++) {
+    const code = raw.charCodeAt(i);
+    if (code <= 0x20 || code === 0x7f) return null;
+  }
+  if (raw.includes('@')) return null; // userinfo has no business in a Host header
+
+  let host;
+  if (raw.startsWith('[')) {
+    const end = raw.indexOf(']');
+    if (end === -1) return null;
+    host = raw.slice(1, end);
+    const rest = raw.slice(end + 1);
+    if (rest && !(rest.startsWith(':') && validPort(rest.slice(1)))) return null;
+  } else {
+    const parts = raw.split(':');
+    if (parts.length > 2) return null; // bare IPv6 without brackets, or garbage
+    host = parts[0];
+    if (parts.length === 2 && !validPort(parts[1])) return null;
+  }
+
+  if (!host) return null;
+  if (host.endsWith('.')) host = host.slice(0, -1); // one trailing root dot is legal
+  if (!host) return null;
+  return host.toLowerCase();
+}
+
+function parseList(value) {
+  return String(value || '')
+    .split(',')
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+function getFlag(name) {
+  const idx = process.argv.findIndex((a) => a === `--${name}` || a.startsWith(`--${name}=`));
+  if (idx === -1) return null;
+  const arg = process.argv[idx];
+  if (arg.includes('=')) return arg.slice(arg.indexOf('=') + 1);
+  const next = process.argv[idx + 1];
+  return next && !next.startsWith('--') ? next : null;
+}
+
+/**
+ * @param {{appName?: string}} [config]
+ */
+function createNetGuard(config = {}) {
+  const appName = config.appName || 'This app';
+
+  const BIND_HOST = getFlag('host') || process.env.HOST || '127.0.0.1';
+  const BIND_HOST_LC = BIND_HOST.toLowerCase();
+  const EXPOSED = !isLoopbackAddress(BIND_HOST);
+  // Resolved here and re-exported so the hub can forward the same value to its
+  // children rather than re-parsing the flag with its own argv scanner — a parent
+  // and child that disagree means the shell serves while every iframe 403s.
+  const ALLOWED_HOSTS = getFlag('allowed-hosts') || process.env.ALLOWED_HOSTS || '';
+  const extraHosts = new Set(parseList(ALLOWED_HOSTS));
+
+  // The hub frames each sub-app, so its origin must be accepted as an Origin and
+  // permitted as a framing ancestor.
+  let hubOrigin = null;
+  if (process.env.HUB_URL) {
+    try { hubOrigin = new URL(process.env.HUB_URL).origin; } catch { /* ignore a malformed HUB_URL */ }
+  }
+
+  // Resolved only once listen() succeeds — the requested port may have been busy.
+  let actualPort = null;
+
+  function hostAllowed(host) {
+    if (!host) return false;
+    if (isLoopbackAddress(host)) return true;
+    if (extraHosts.has(host)) return true;
+    // Binding a specific non-loopback address implies that address is a valid name for us.
+    if (EXPOSED && host === BIND_HOST_LC) return true;
+    return false;
+  }
+
+  function hostGuard(req, res, next) {
+    const host = parseHostHeader(req.headers.host);
+    if (hostAllowed(host)) return next();
+    res.status(403).type('text/plain').send(
+      `403 Forbidden - unrecognized Host header: ${req.headers.host || '(none)'}\n\n` +
+      `${appName} only answers requests addressed to localhost. This protects you\n` +
+      `from DNS rebinding, where a website you visit re-points its own hostname at\n` +
+      `127.0.0.1 in order to read your local data.\n\n` +
+      `If you meant to reach this from another machine, restart with:\n` +
+      `  --host 0.0.0.0 --allowed-hosts=${host || '<your-hostname>'}\n\n` +
+      `Only do that on a network you trust - there is no authentication.\n`
+    );
+  }
+
+  // true = allow, false = block, null = no Origin header, caller decides.
+  function originVerdict(origin) {
+    if (!origin || origin === 'null') return null;
+    let parsed;
+    try { parsed = new URL(origin); } catch { return false; }
+    if (hubOrigin && parsed.origin === hubOrigin) return true;
+    if (!isLoopbackAddress(parsed.hostname)) return false;
+    // Same port, any loopback spelling. A different local port is a different app
+    // and has no business driving this one.
+    if (actualPort && parsed.port && Number(parsed.port) !== Number(actualPort)) return false;
+    return true;
+  }
+
+  function originGuard(req, res, next) {
+    if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') return next();
+
+    const verdict = originVerdict(req.headers.origin);
+    if (verdict === true) return next();
+    if (verdict === false) {
+      return res.status(403).type('text/plain')
+        .send(`403 Forbidden - cross-origin ${req.method} from ${req.headers.origin} is not allowed.\n`);
+    }
+
+    // No Origin header: a non-browser client (curl, the CLI, the hub's own fetch).
+    // Trust it unless the browser explicitly tells us otherwise.
+    const site = req.headers['sec-fetch-site'];
+    if (site && site !== 'same-origin' && site !== 'none') {
+      return res.status(403).type('text/plain')
+        .send(`403 Forbidden - cross-site ${req.method} (Sec-Fetch-Site: ${site}) is not allowed.\n`);
+    }
+    return next();
+  }
+
+  // Constant for the life of the process, and frameGuard runs ahead of
+  // express.static — so this is built once rather than per asset fetch.
+  //
+  // Under the hub, X-Frame-Options is deliberately omitted: it has no multi-origin
+  // form, and sending SAMEORIGIN would break the hub's iframes.
+  //
+  // The port is wildcarded rather than pinned to HUB_URL's. The hub spawns its
+  // children before it binds, so if its own preferred port is busy it hands them a
+  // HUB_URL with the wrong port and every iframe would break. Any loopback port may
+  // frame us; that is not the threat being addressed here — a remote page still
+  // cannot, which is what matters.
+  //
+  // No IPv6 literal: Chrome rejects `http://[::1]:*` as a source expression and
+  // logs it on every framed load. The hub's own origin is added verbatim instead,
+  // which covers a hub reached over [::1].
+  let CSP;
+  if (hubOrigin) {
+    const ancestors = ["'self'", 'http://localhost:*', 'http://127.0.0.1:*'];
+    if (!/^http:\/\/(localhost|127\.0\.0\.1)(:|$)/.test(hubOrigin)) ancestors.push(hubOrigin);
+    CSP = `frame-ancestors ${ancestors.join(' ')}`;
+  } else {
+    CSP = "frame-ancestors 'none'";
+  }
+
+  function frameGuard(_req, res, next) {
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Referrer-Policy', 'no-referrer');
+    res.setHeader('Content-Security-Policy', CSP);
+    if (!hubOrigin) res.setHeader('X-Frame-Options', 'DENY');
+    next();
+  }
+
+  /**
+   * Bind BIND_HOST, then opportunistically serve the other loopback family on the
+   * same resolved port via a second server sharing the same request handler.
+   *
+   * That second bind is what keeps `http://localhost:<port>` working no matter how
+   * the OS resolver orders A/AAAA records - binding only 127.0.0.1 breaks hosts
+   * where `localhost` resolves to ::1, and vice versa. Doing it on the *resolved*
+   * port means every existing URL, startup banner and postMessage origin is
+   * unchanged. Failures are swallowed: it is an optimization, not a requirement.
+   *
+   * Returns the primary server, so callers keep attaching their own 'error'
+   * handler for the EADDRINUSE fallback.
+   *
+   * @param {any} app express app (or any http request handler)
+   * @param {number} port 0 selects a free port
+   * @param {(port: number) => void} [onReady]
+   * @param {{maxHeaderSize?: number}} [opts]
+   */
+  function listenLoopback(app, port, onReady, opts = {}) {
+    const http = require('http');
+    const serverOpts = opts.maxHeaderSize ? { maxHeaderSize: opts.maxHeaderSize } : {};
+    const makeServer = (handler) => http.createServer(serverOpts, handler);
+    const server = makeServer(app);
+    let secondary = null;
+
+    server.on('listening', () => {
+      actualPort = server.address().port;
+      if (!EXPOSED) {
+        const otherFamily = BIND_HOST.includes(':') ? '127.0.0.1' : '::1';
+        try {
+          secondary = makeServer(app);
+          secondary.on('error', () => {}); // that family may not exist on this host
+          secondary.listen({ host: otherFamily, port: actualPort, ipv6Only: otherFamily === '::1' });
+        } catch { /* best effort */ }
+      }
+      if (onReady) onReady(actualPort);
+    });
+    server.on('close', () => { try { if (secondary) secondary.close(); } catch { /* already gone */ } });
+
+    server.listen(port, BIND_HOST);
+    return server;
+  }
+
+  function exposureWarning() {
+    if (!EXPOSED) return null;
+    return `WARNING: listening on ${BIND_HOST} - reachable from your network, with no authentication.`;
+  }
+
+  return { BIND_HOST, ALLOWED_HOSTS, hostGuard, originGuard, frameGuard, listenLoopback, exposureWarning };
+}
+
+module.exports = { createNetGuard, parseHostHeader, isLoopbackAddress };

package/lib/open-editor.js

@@ -0,0 +1,267 @@
+'use strict';
+
+// Launch a GUI editor without ever handing a string to a shell.
+//
+// The naive fix for command injection here — dropping `shell: true` — does not
+// work on Windows, and fails in two different ways:
+//
+//   * `spawn('code', args)` throws ENOENT, because the launcher on PATH is
+//     `code.cmd` and Node does not consult PATHEXT.
+//   * Resolving to `code.cmd` and spawning that throws EINVAL, because since the
+//     CVE-2024-27980 fix (Node 18.20.2 / 20.12.2 / 21.7.3+) a .bat/.cmd target
+//     may only be spawned with `shell: true` — the very thing we are removing.
+//
+// So on Windows we resolve the real .exe sitting behind the .cmd shim and spawn
+// that directly. Only when no such .exe exists (npm-style shims, which are node
+// scripts with no binary twin) do we fall back to cmd.exe, and that path applies
+// a character allowlist so the quoting cannot be broken out of.
+//
+// CANONICAL COPY: scripts/security-lib/open-editor.js in the claude-code-hub repo.
+// Duplicated verbatim into cck/, marketplace/ and memory/ — they are independent
+// npm packages and cannot import from each other. Run scripts/sync-security-lib.sh
+// after editing.
+
+const { spawn } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+
+const IS_WIN = process.platform === 'win32';
+
+// Editors whose CLI understands `-n` (open in a new window). Passing it to
+// vim/nano/emacs would be wrong, so it is only injected for this family.
+const VSCODE_FAMILY = new Set([
+  'code', 'code-insiders', 'codium', 'vscodium', 'cursor', 'windsurf', 'positron', 'trae',
+]);
+
+// Characters that survive cmd.exe's double quotes and would let an argument
+// escape it. Inside "..." cmd treats & | < > ^ ( ) as literal, so only these
+// matter: '"' ends the quoted run, '%' triggers variable expansion whose value
+// could itself contain a quote. Neither is legal in an NTFS path anyway.
+const WIN_CMD_FORBIDDEN = /["%\r\n\u0000]/;
+
+function fail(message, status) {
+  return Object.assign(new Error(message), { status });
+}
+
+// Split an EDITOR value into argv. Handles `EDITOR="code -w"` and quoted paths
+// such as `"C:\Program Files\App\app.exe" --flag`. No expansion, no globbing —
+// EDITOR is operator-supplied, not request-supplied.
+function splitCommandLine(str) {
+  if (typeof str !== 'string') return []; // String(undefined) would yield an "undefined" argv entry
+  const out = [];
+  let cur = '';
+  let quote = null;
+  let quoted = false;
+  for (const ch of String(str)) {
+    if (quote) {
+      if (ch === quote) quote = null;
+      else cur += ch;
+      continue;
+    }
+    if (ch === '"' || ch === "'") { quote = ch; quoted = true; continue; }
+    if (/\s/.test(ch)) {
+      if (cur || quoted) { out.push(cur); cur = ''; quoted = false; }
+      continue;
+    }
+    cur += ch;
+  }
+  if (cur || quoted) out.push(cur);
+  return out;
+}
+
+// The PATH walk below stats PATH.length × PATHEXT.length candidates — on a
+// typical Windows box ~1200 stats, several milliseconds. The answer cannot change
+// within a process unless PATH itself does, so it is memoized on both.
+const whichCache = new Map();
+
+// which(1). On Windows this walks PATHEXT so we learn the resolved extension —
+// that .cmd-vs-.exe distinction is what selects the launch strategy below.
+function whichSync(cmd) {
+  if (!cmd) return null;
+  if (cmd.includes('/') || cmd.includes('\\')) {
+    const abs = path.resolve(cmd);
+    try { return fs.statSync(abs).isFile() ? abs : null; } catch { return null; }
+  }
+  const key = `${process.env.PATH || ''}\u0000${process.env.PATHEXT || ''}\u0000${cmd}`;
+  if (whichCache.has(key)) return whichCache.get(key);
+  const found = whichUncached(cmd);
+  whichCache.set(key, found);
+  return found;
+}
+
+function whichUncached(cmd) {
+  const dirs = (process.env.PATH || '').split(path.delimiter).filter(Boolean);
+  const exts = IS_WIN
+    ? (process.env.PATHEXT || '.COM;.EXE;.BAT;.CMD').split(';').filter(Boolean)
+    : [''];
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const candidate = path.join(dir, cmd + ext);
+      try { if (fs.statSync(candidate).isFile()) return candidate; } catch { /* next */ }
+    }
+  }
+  return null;
+}
+
+// A GUI editor's .cmd shim normally lives at <install>/bin/foo.cmd next to
+// <install>/Foo.exe. Returns that .exe so we can skip the shell entirely.
+// npm-installed shims have no such twin and correctly return null here.
+function exeBehindShim(shimPath) {
+  const bin = path.dirname(shimPath);
+  const root = path.dirname(bin);
+  const stem = path.basename(shimPath, path.extname(shimPath));
+  const candidates = [
+    path.join(root, `${stem}.exe`),
+    path.join(bin, `${stem}.exe`),
+    path.join(root, 'Code.exe'),
+    path.join(root, 'Cursor.exe'),
+    path.join(root, 'Windsurf.exe'),
+    path.join(root, 'VSCodium.exe'),
+    path.join(root, 'Positron.exe'),
+  ];
+  for (const candidate of candidates) {
+    try { if (fs.statSync(candidate).isFile()) return candidate; } catch { /* next */ }
+  }
+  return null;
+}
+
+function launchViaCmd(exe, args) {
+  for (const arg of [exe, ...args]) {
+    if (WIN_CMD_FORBIDDEN.test(arg)) {
+      throw fail('Path contains a character that cannot be passed safely to this editor', 400);
+    }
+  }
+  const line = [exe, ...args].map((a) => `"${a}"`).join(' ');
+  return spawn(process.env.ComSpec || 'cmd.exe', ['/d', '/s', '/c', `"${line}"`], {
+    windowsVerbatimArguments: true,
+    windowsHide: true,
+    stdio: 'ignore',
+    detached: true,
+  });
+}
+
+let cachedEditor;
+
+function resolveEditor() {
+  const spec = (process.env.EDITOR || '').trim() || 'code';
+  if (cachedEditor && cachedEditor.spec === spec) return cachedEditor;
+  const parts = splitCommandLine(spec);
+  const cmd = parts[0];
+  if (!cmd) throw fail('No editor configured (set EDITOR)', 500);
+  const resolved = whichSync(cmd);
+  if (!resolved) throw fail(`Editor not found on PATH: ${cmd}`, 500);
+  cachedEditor = { spec, resolved, preArgs: parts.slice(1) };
+  return cachedEditor;
+}
+
+/**
+ * Validate a request-supplied path before it becomes an editor argument, and
+ * return its resolved absolute form. Lives here rather than in each server so the
+ * rule cannot drift between the apps that share this helper.
+ *
+ * Deliberately not a containment check: opening an arbitrary project directory is
+ * the feature these endpoints exist for. The network boundary is the control.
+ *
+ * @param {unknown} value
+ * @param {string} label used in the error message
+ * @returns {string} resolved absolute path
+ */
+function assertOpenTarget(value, label = 'path') {
+  if (typeof value !== 'string' || !value.trim()) throw fail(`${label} must be a non-empty string`, 400);
+  if (/[\r\n\u0000]/.test(value)) throw fail(`${label} contains invalid characters`, 400);
+  const resolved = path.resolve(value);
+  if (!fs.existsSync(resolved)) throw fail(`${label} does not exist`, 404);
+  return resolved;
+}
+
+/**
+ * Open one or more already-validated absolute paths in the user's editor.
+ * @param {string[]} targets
+ * @param {{newWindow?: boolean}} [opts]
+ */
+function openInEditor(targets, opts = {}) {
+  const list = (Array.isArray(targets) ? targets : [targets]).filter(Boolean);
+  if (!list.length) throw fail('Nothing to open', 400);
+
+  const { resolved, preArgs } = resolveEditor();
+  const stem = path.basename(resolved, path.extname(resolved)).toLowerCase();
+
+  const flags = [...preArgs];
+  if (opts.newWindow !== false && VSCODE_FAMILY.has(stem) && !flags.includes('-n')) {
+    flags.unshift('-n');
+  }
+  const argv = [...flags, ...list];
+
+  const ext = path.extname(resolved).toLowerCase();
+  if (IS_WIN && (ext === '.cmd' || ext === '.bat')) {
+    const exe = exeBehindShim(resolved);
+    if (exe) return spawn(exe, argv, { stdio: 'ignore', detached: true, windowsHide: true }).unref();
+    return launchViaCmd(resolved, argv).unref();
+  }
+
+  return spawn(resolved, argv, { stdio: 'ignore', detached: true }).unref();
+}
+
+/**
+ * Run a command without a shell and capture its output. Same Windows .cmd
+ * strategy as openInEditor: prefer the real .exe, fall back to an explicitly
+ * quoted cmd.exe line guarded by the character allowlist. Callers must still
+ * validate every argument — this stops shell metacharacters, not bad flags.
+ * @param {string} cmd
+ * @param {string[]} args
+ * @param {{cwd?: string, timeout?: number}} [opts]
+ * @returns {Promise<{stdout: string, stderr: string}>}
+ */
+function execNoShell(cmd, args, opts = {}) {
+  return new Promise((resolve, reject) => {
+    const resolved = whichSync(cmd);
+    if (!resolved) return reject(fail(`Command not found on PATH: ${cmd}`, 500));
+
+    let file = resolved;
+    let argv = args;
+    const spawnOpts = {
+      cwd: opts.cwd || undefined,
+      timeout: opts.timeout,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    };
+
+    const ext = path.extname(resolved).toLowerCase();
+    if (IS_WIN && (ext === '.cmd' || ext === '.bat')) {
+      const exe = exeBehindShim(resolved);
+      if (exe) {
+        file = exe;
+      } else {
+        for (const arg of [resolved, ...args]) {
+          if (WIN_CMD_FORBIDDEN.test(String(arg))) {
+            return reject(fail('Argument contains a character that cannot be passed safely', 400));
+          }
+        }
+        const line = [resolved, ...args].map((a) => `"${a}"`).join(' ');
+        file = process.env.ComSpec || 'cmd.exe';
+        argv = ['/d', '/s', '/c', `"${line}"`];
+        spawnOpts.windowsVerbatimArguments = true;
+      }
+    }
+
+    let child;
+    try {
+      child = spawn(file, argv, spawnOpts);
+    } catch (err) {
+      return reject(err);
+    }
+
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (d) => { stdout += d; });
+    child.stderr.on('data', (d) => { stderr += d; });
+    child.on('error', reject);
+    child.on('close', (code, signal) => {
+      if (signal) return reject(new Error(`Command terminated by ${signal}: ${stderr.trim()}`));
+      if (code !== 0) return reject(new Error(stderr.trim() || `Command exited with code ${code}`));
+      resolve({ stdout, stderr });
+    });
+  });
+}
+
+module.exports = { assertOpenTarget, openInEditor, execNoShell, whichSync, splitCommandLine, exeBehindShim };

package/package.json

@@ -1,15 +1,16 @@
 {
   "name": "claude-code-memory-explorer",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Memory explorer dashboard for Claude Code",
   "main": "server.js",
   "bin": {
-    "claude-code-memory-explorer": "./server.js"
+    "claude-code-memory-explorer": "server.js"
   },
   "scripts": {
     "start": "node server.js",
     "dev": "node server.js --open",
-    "prepare": "husky || true"
+    "prepare": "husky || true",
+    "test": "node --test test/*.test.js"
   },
   "engines": {
     "node": ">=20.0.0"
@@ -44,6 +45,7 @@
   "license": "MIT",
   "files": [
     "server.js",
+    "lib/",
     "public/",
     "README.md",
     "LICENSE"

package/public/app.js

@@ -9,12 +9,23 @@ let selectedFileId = null;
 
 // #region UTILS
 
+const HTML_ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;', '`': '&#96;' };
+
 function esc(s) {
-  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  if (s == null) return '';
+  return String(s).replace(/[&<>"'`]/g, (c) => HTML_ESCAPES[c]);
 }
 
-function escJs(s) {
-  return s.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+// For a value landing inside a quoted JS string inside an HTML attribute —
+// onclick="fn('${escAttrJs(x)}')". The browser HTML-decodes the attribute before
+// the JS parser sees it, so the JS escape must happen first and be escaped in turn.
+function escAttrJs(value) {
+  const js = String(value == null ? '' : value)
+    .replace(/\\/g, '\\\\')
+    .replace(/'/g, "\\'")
+    .replace(/\r/g, '\\r')
+    .replace(/\n/g, '\\n');
+  return esc(js);
 }
 
 // #endregion UTILS
@@ -64,7 +75,7 @@ function linkifyImports(text, _sourceId) {
   const ph = (child, display) => {
     const token = `\x00LINK${placeholders.length}\x00`;
     placeholders.push(
-      `<a class="inline-import" href="#" onclick="selectFile('${escJs(child.id)}');return false" title="${esc(child.path)}">${esc(display)}</a>`,
+      `<a class="inline-import" href="#" onclick="selectFile('${escAttrJs(child.id)}');return false" title="${esc(child.path)}">${esc(display)}</a>`,
     );
     return token;
   };
@@ -273,9 +284,9 @@ function renderRecentProjects() {
     recent
       .map(
         (p) =>
-          `<div class="recent-project-item" onclick="_selectRecentProject('${escJs(p)}')">` +
+          `<div class="recent-project-item" onclick="_selectRecentProject('${escAttrJs(p)}')">` +
           `<span>${esc(p)}</span>` +
-          `<button class="recent-project-remove" onclick="_removeRecentProject('${escJs(p)}', event)" title="Remove">&#10005;</button>` +
+          `<button class="recent-project-remove" onclick="_removeRecentProject('${escAttrJs(p)}', event)" title="Remove">&#10005;</button>` +
           `</div>`,
       )
       .join('');
@@ -385,9 +396,9 @@ function renderTree() {
     const children = childrenOf[item.id];
     const expanded = children && isItemExpanded(item.id);
     const chevron = children
-      ? `<span class="tree-chevron" onclick="_toggleItem(event,'${escJs(item.id)}')" title="${children.length} referenced">${expanded ? '▾' : '▸'}</span>`
+      ? `<span class="tree-chevron" onclick="_toggleItem(event,'${escAttrJs(item.id)}')" title="${children.length} referenced">${expanded ? '▾' : '▸'}</span>`
       : '<span class="tree-chevron-spacer"></span>';
-    let h = `<div class="tree-item${sel}${indent ? ' tree-child' : ''}${isConditional ? ' tree-conditional' : ''}${muted}" data-id="${esc(item.id)}" title="${esc(item.path)}" onclick="selectFile('${escJs(item.id)}')"${pad}>`;
+    let h = `<div class="tree-item${sel}${indent ? ' tree-child' : ''}${isConditional ? ' tree-conditional' : ''}${muted}" data-id="${esc(item.id)}" title="${esc(item.path)}" onclick="selectFile('${escAttrJs(item.id)}')"${pad}>`;
     h += chevron;
     h += `<span class="load-icon" title="${loadTitle}" style="color:var(--scope-${item.scope})">${loadIcon}</span>`;
     h += `<span class="file-name">${esc(item.name)}</span>`;
@@ -408,7 +419,7 @@ function renderTree() {
     const collapsed = collapsible && isGroupCollapsed(scope);
     const chevron = collapsible ? `<span class="group-chevron">${collapsed ? '\u25B8' : '\u25BE'}</span>` : '';
     const headerClass = collapsible ? 'tree-group-header tree-group-clickable' : 'tree-group-header';
-    const onclick = collapsible ? ` onclick="_toggleGroup('${escJs(scope)}')"` : '';
+    const onclick = collapsible ? ` onclick="_toggleGroup('${escAttrJs(scope)}')"` : '';
     html += `<div class="${headerClass}" data-scope="${esc(scope)}"${onclick}>${chevron}<span class="scope-dot" style="color:var(--scope-${scope})">\u25CF</span> ${esc(label)} <span style="opacity:0.5">${items.length}</span></div>`;
     if (collapsed) continue;
     if (scope === 'agent-memory') {
@@ -505,7 +516,7 @@ function selectFile(id, pushState = true) {
 }
 
 function scrollToSelected() {
-  const el = document.querySelector(`.tree-item[data-id="${selectedFileId}"]`);
+  const el = document.querySelector(`.tree-item[data-id="${CSS.escape(selectedFileId ?? '')}"]`);
   if (el) el.scrollIntoView({ block: 'nearest' });
 }
 
@@ -608,7 +619,7 @@ function renderMemoryIndexTable(entries) {
     const type = typeMatch ? typeMatch[1] : 'memory';
     const scopeColor = TYPE_COLORS[type] || 'memory';
     const nameHtml = child
-      ? `<a class="import-link" href="#" onclick="selectFile('${escJs(child.id)}');return false" title="${esc(child.path)}">${esc(entry.name)}</a>`
+      ? `<a class="import-link" href="#" onclick="selectFile('${escAttrJs(child.id)}');return false" title="${esc(child.path)}">${esc(entry.name)}</a>`
       : `<span class="import-link unresolved" title="Not found: ${esc(entry.file)}">⚠ ${esc(entry.name)}</span>`;
     html += `<div class="memory-index-row">`;
     html += `<span class="scope-badge scope-${scopeColor} memory-index-type">${esc(type)}</span>`;
@@ -649,11 +660,11 @@ async function renderPreview() {
   if (isMemoryIndex(source)) {
     const broken = (source.unresolvedImports || []).length;
     if (broken) {
-      html += `<button class="action-btn small" onclick="_cleanupOrphans('${escJs(source.path)}')" title="Cleanup ${broken} orphaned refs"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 6h18"/><path d="M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/><path d="M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6"/><path d="M12 11v6"/></svg><span style="margin-left:3px">${broken}</span></button>`;
+      html += `<button class="action-btn small" onclick="_cleanupOrphans('${escAttrJs(source.path)}')" title="Cleanup ${broken} orphaned refs"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 6h18"/><path d="M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/><path d="M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6"/><path d="M12 11v6"/></svg><span style="margin-left:3px">${broken}</span></button>`;
     }
   }
-  html += `<button class="action-btn small" onclick="openInEditor('${escJs(source.path)}')" title="Open in VS Code"><svg width="12" height="12" viewBox="0 0 24 24" fill="currentColor" stroke="none"><path d="M17.583 2.207a1.1 1.1 0 0 1 1.541.033l2.636 2.636a1.1 1.1 0 0 1 .033 1.541L10.68 17.53a1.1 1.1 0 0 1-.345.247l-4.56 1.903a.55.55 0 0 1-.725-.725l1.903-4.56a1.1 1.1 0 0 1 .247-.345zm.902 1.87-8.794 8.793-.946 2.268 2.268-.946 8.794-8.793z"/></svg></button>`;
-  html += `<button class="action-btn small" onclick="_confirmDeleteFile('${escJs(source.path)}','${escJs(source.name)}')" title="Delete file"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="3 6 5 6 21 6"/><path d="M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6"/><path d="M10 11v6M14 11v6"/><path d="M9 6V4a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v2"/></svg></button>`;
+  html += `<button class="action-btn small" onclick="openInEditor('${escAttrJs(source.path)}')" title="Open in VS Code"><svg width="12" height="12" viewBox="0 0 24 24" fill="currentColor" stroke="none"><path d="M17.583 2.207a1.1 1.1 0 0 1 1.541.033l2.636 2.636a1.1 1.1 0 0 1 .033 1.541L10.68 17.53a1.1 1.1 0 0 1-.345.247l-4.56 1.903a.55.55 0 0 1-.725-.725l1.903-4.56a1.1 1.1 0 0 1 .247-.345zm.902 1.87-8.794 8.793-.946 2.268 2.268-.946 8.794-8.793z"/></svg></button>`;
+  html += `<button class="action-btn small" onclick="_confirmDeleteFile('${escAttrJs(source.path)}','${escAttrJs(source.name)}')" title="Delete file"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="3 6 5 6 21 6"/><path d="M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6"/><path d="M10 11v6M14 11v6"/><path d="M9 6V4a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v2"/></svg></button>`;
   html += '</div></div>';
 
   // Badges row
@@ -677,7 +688,7 @@ async function renderPreview() {
   if (!showMemoryTable && (children.length || unresolved.length)) {
     html += '<div class="preview-imports">';
     for (const child of children) {
-      html += `<a class="import-link" href="#" onclick="selectFile('${escJs(child.id)}');return false" title="${esc(child.path)}">${esc(child.name)}</a>`;
+      html += `<a class="import-link" href="#" onclick="selectFile('${escAttrJs(child.id)}');return false" title="${esc(child.path)}">${esc(child.name)}</a>`;
     }
     for (const u of unresolved) {
       html += `<span class="import-link unresolved" title="Not found: ${esc(u)}">⚠ ${esc(u)}</span>`;
@@ -981,11 +992,7 @@ document.addEventListener('keydown', (e) => {
     .catch(() => ({}));
   if (!cfg.enabled) return;
   window.__HUB__ = cfg;
-  const fwd = (e) =>
-    window.parent?.postMessage(
-      { type: 'hub:keydown', key: e.key, ctrl: e.ctrlKey, alt: e.altKey, shift: e.shiftKey },
-      '*',
-    );
+  const fwd = (e) => hubPost({ type: 'hub:keydown', key: e.key, ctrl: e.ctrlKey, alt: e.altKey, shift: e.shiftKey });
   document.addEventListener('keydown', (e) => {
     if (e.ctrlKey && e.altKey && (e.key === 'ArrowLeft' || e.key === 'ArrowRight')) {
       e.preventDefault();
@@ -1005,12 +1012,19 @@ document.addEventListener('keydown', (e) => {
 
 function _hubNavigate(app, url) {
   if (!window.__HUB__?.enabled) return;
-  window.parent?.postMessage({ type: 'hub:navigate', app, url }, '*');
+  hubPost({ type: 'hub:navigate', app, url });
 }
 
 // Hoisted out of initHubTheme so initHubProject can share it.
 const hubOrigin = () => (window.__HUB__?.url ? new URL(window.__HUB__.url).origin : null);
 
+// Every send is addressed to the hub explicitly. With targetOrigin '*' any page that
+// framed this app also received the forwarded keystrokes and navigation intents.
+function hubPost(message) {
+  const origin = hubOrigin();
+  if (origin) window.parent?.postMessage(message, origin);
+}
+
 (function initHubTheme() {
   const getTheme = () => (document.body.classList.contains('light') ? 'light' : 'dark');
   const getColorTheme = () => document.body.dataset.colorTheme || 'ember';
@@ -1036,8 +1050,7 @@ const hubOrigin = () => (window.__HUB__?.url ? new URL(window.__HUB__.url).origi
     if (t === lastTheme && ct === lastColorTheme) return;
     lastTheme = t;
     lastColorTheme = ct;
-    const origin = hubOrigin();
-    if (origin) window.parent.postMessage({ type: 'hub:theme', theme: t, colorTheme: ct }, origin);
+    hubPost({ type: 'hub:theme', theme: t, colorTheme: ct });
   }).observe(document.body, {
     attributes: true,
     attributeFilter: ['class', 'data-color-theme'],
@@ -1062,6 +1075,10 @@ let hubProjectPath = null;
     lastApplied = dirPath;
     try {
       await putProject(dirPath);
+      // The hub does not persist its own scope, so a hub-pushed project must become the recent
+      // head here: after a hard refresh the boot path PUTs getRecentProjects()[0], which would
+      // otherwise clobber the server's hub-scoped project with the previous one.
+      addRecentProject(dirPath);
       await Promise.all([loadProject(), loadData()]);
     } catch (err) {
       lastApplied = null;

package/server.js

@@ -6,6 +6,8 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 const { execFileSync } = require('child_process');
+const { assertOpenTarget, openInEditor } = require('./lib/open-editor');
+const { createNetGuard } = require('./lib/net-guard');
 
 // #region CLI_ARGS
 
@@ -17,7 +19,7 @@ function getArg(name) {
   return process.argv[eqIdx + 1] || null;
 }
 
-const expandHome = (p) => (p || '').replace(/^~/, os.homedir());
+const expandHome = (p) => (typeof p === 'string' ? p : '').replace(/^~/, os.homedir());
 
 const PORT = getArg('port') || process.env.PORT || 3544;
 const AUTO_OPEN = process.argv.includes('--open');
@@ -441,7 +443,10 @@ function findMemoryDir(projectPath) {
 
 function findMainWorktreePath(projectPath) {
   try {
-    const out = execFileSync('git', ['-C', projectPath, 'rev-parse', '--git-common-dir'], {
+    // cwd rather than `-C <path>`: a projectPath beginning with a dash would
+    // otherwise be parsed by git as a flag instead of a directory.
+    const out = execFileSync('git', ['rev-parse', '--git-common-dir'], {
+      cwd: projectPath,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'ignore'],
       timeout: 2000,
@@ -512,6 +517,13 @@ function stripContent(source) {
 // #region EXPRESS
 
 const app = express();
+
+// Mounted before express.json() so a rejected request never buffers a body.
+const net = createNetGuard({ appName: 'Claude Code Memory' });
+app.use(net.hostGuard);
+app.use(net.frameGuard);
+app.use(net.originGuard);
+
 app.use(express.json());
 app.use(express.static(path.join(__dirname, 'public')));
 
@@ -606,15 +618,12 @@ app.post('/api/memory/cleanup-orphans', (req, res) => {
 });
 
 app.post('/api/open-in-editor', (req, res) => {
-  const { path: filePath } = req.body;
-  if (!filePath) return res.status(400).json({ error: 'path required' });
-  const resolved = expandHome(filePath);
-  if (!fs.existsSync(resolved)) return res.status(404).json({ error: 'file not found' });
-  const { exec } = require('child_process');
-  exec(`code "${resolved}"`, (err) => {
-    if (err) return res.status(500).json({ error: err.message });
+  try {
+    openInEditor([assertOpenTarget(expandHome(req.body.path))]);
     res.json({ ok: true });
-  });
+  } catch (err) {
+    res.status(err.status || 500).json({ error: err.message });
+  }
 });
 
 app.get('/api/summary', (_req, res) => {
@@ -696,27 +705,22 @@ app.get('/api/imports', (req, res) => {
 
 // #region STARTUP
 
-const server = app.listen(PORT, () => {
-  const addr = server.address();
-  const port = typeof addr === 'object' ? addr.port : PORT;
+const onReady = (port) => {
   console.log(`Claude Code Memory running at http://localhost:${port}`);
   console.log(`Project: ${currentProjectPath}`);
+  const warning = net.exposureWarning();
+  if (warning) console.log(warning);
   if (AUTO_OPEN) {
     import('open').then(m => m.default(`http://localhost:${port}`)).catch(() => {});
   }
-});
+};
+
+const server = net.listenLoopback(app, PORT, onReady);
 
 server.on('error', (err) => {
   if (err.code === 'EADDRINUSE') {
     console.log(`Port ${PORT} busy, trying random port...`);
-    const retry = app.listen(0, () => {
-      const addr = retry.address();
-      const port = typeof addr === 'object' ? addr.port : '?';
-      console.log(`Claude Code Memory running at http://localhost:${port}`);
-      if (AUTO_OPEN) {
-        import('open').then(m => m.default(`http://localhost:${port}`)).catch(() => {});
-      }
-    });
+    net.listenLoopback(app, 0, onReady);
   }
 });