claude-code-memory-explorer 1.1.0 → 1.1.2

package/lib/net-guard.js

@@ -37,11 +37,14 @@ const PORT_RE = /^[0-9]{1,5}$/;
 // port dynamic, so only the host is allowlisted.
 const validPort = (p) => PORT_RE.test(p) && Number(p) >= 1 && Number(p) <= 65535;
 const KEEP_ALIVE_MS = 65000;
+// A whole IPv4 literal: a prefix test would let a rebinding name like 127.evil.com through.
+const LOOPBACK_V4_RE = /^127(?:\.(?:25[0-5]|2[0-4]\d|1?\d?\d)){3}$/;
 
 function isLoopbackAddress(host) {
   if (!host) return false;
-  const h = String(host).toLowerCase();
-  return LOOPBACK_HOSTS.has(h) || h.startsWith('127.');
+  // An Origin or URL host carries an IPv6 literal in brackets.
+  const h = String(host).toLowerCase().replace(/^\[(.*)\]$/, '$1');
+  return LOOPBACK_HOSTS.has(h) || LOOPBACK_V4_RE.test(h);
 }
 
 // Hand-parsed rather than via new URL(), which is far more permissive than we
@@ -102,7 +105,7 @@ function getFlag(name) {
 }
 
 /**
- * @param {{appName?: string}} [config]
+ * @param {{appName?: string, selfFramedPaths?: string[]}} [config]
  */
 function createNetGuard(config = {}) {
   const appName = config.appName || 'This app';
@@ -216,9 +219,18 @@ function createNetGuard(config = {}) {
     CSP = "frame-ancestors 'none'";
   }
 
-  function frameGuard(_req, res, next) {
+  // Alone, these pages may be framed by this app's own port under its loopback names, for a page
+  // that frames itself from its other name to get its own renderer process.
+  const selfFramed = new Set(config.selfFramedPaths || []);
+
+  function frameGuard(req, res, next) {
     res.setHeader('X-Content-Type-Options', 'nosniff');
     res.setHeader('Referrer-Policy', 'no-referrer');
+    if (!hubOrigin && selfFramed.has(req.path)) {
+      const port = req.socket.localPort;
+      res.setHeader('Content-Security-Policy', `frame-ancestors 'self' http://localhost:${port} http://127.0.0.1:${port}`);
+      return next();
+    }
     res.setHeader('Content-Security-Policy', CSP);
     if (!hubOrigin) res.setHeader('X-Frame-Options', 'DENY');
     next();
@@ -232,7 +244,10 @@ function createNetGuard(config = {}) {
    * the OS resolver orders A/AAAA records - binding only 127.0.0.1 breaks hosts
    * where `localhost` resolves to ::1, and vice versa. Doing it on the *resolved*
    * port means every existing URL, startup banner and postMessage origin is
-   * unchanged. Failures are swallowed: it is an optimization, not a requirement.
+   * unchanged. A family the host does not have is skipped. A port that another
+   * process holds on the other family is treated as busy: the primary closes and
+   * emits EADDRINUSE (port 0 picks another random port instead), because that process would answer `localhost:<port>` (and a
+   * cross-site frame on it) in our name. onReady waits for the second bind.
    *
    * Returns the primary server, so callers keep attaching their own 'error'
    * handler for the EADDRINUSE fallback.
@@ -259,18 +274,30 @@ function createNetGuard(config = {}) {
     };
     const server = makeServer(app);
     let secondary = null;
+    let randomTries = 0;
 
     server.on('listening', () => {
-      actualPort = server.address().port;
-      if (!EXPOSED) {
-        const otherFamily = BIND_HOST.includes(':') ? '127.0.0.1' : '::1';
-        try {
-          secondary = makeServer(app);
-          secondary.on('error', () => {}); // that family may not exist on this host
-          secondary.listen({ host: otherFamily, port: actualPort, ipv6Only: otherFamily === '::1' });
-        } catch { /* best effort */ }
+      const boundPort = server.address().port;
+      actualPort = boundPort;
+      // Not actualPort: the hub listens several servers through one guard, and another one can bind
+      // while this one waits for its second family.
+      const ready = () => { if (onReady) onReady(boundPort); };
+      if (EXPOSED) return ready();
+      const otherFamily = BIND_HOST.includes(':') ? '127.0.0.1' : '::1';
+      try {
+        secondary = makeServer(app);
+        secondary.once('listening', ready);
+        secondary.on('error', (err) => {
+          if (err.code !== 'EADDRINUSE') return ready();
+          // A caller asking for port 0 has no fallback of its own, so it gets another random port here.
+          if (port === 0 && ++randomTries < 5) return server.close(() => server.listen(0, BIND_HOST));
+          server.close();
+          server.emit('error', err);
+        });
+        secondary.listen({ host: otherFamily, port: boundPort, ipv6Only: otherFamily === '::1' });
+      } catch {
+        ready();
       }
-      if (onReady) onReady(actualPort);
     });
     server.on('close', () => { try { if (secondary) secondary.close(); } catch { /* already gone */ } });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-memory-explorer",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Memory explorer dashboard for Claude Code",
   "main": "server.js",
   "type": "commonjs",

package/public/vendor/claude-hub-sdk.js

@@ -1,9 +1,18 @@
-// claude-hub-sdk 1.1.0 (sha256 0fed14faa670). Copied by npm run sdk:sync in claude-code-hub. Do not edit.
+// claude-hub-sdk 1.2.0 (sha256 62c7d9f477b2). Copied by npm run sdk:sync in claude-code-hub. Do not edit.
 // Claude Code Hub SDK stub: what an app serves when no hub runs it. Under a hub, the hub hands the
 // app its real SDK (client.js) in place of this file. The API must match client.js; a test checks it.
 ((root) => {
   'use strict';
 
+  // A copy of client.js comboOf(); a test checks they match.
+  function comboOf(e) {
+    const lower = typeof e.key === 'string' ? e.key.toLowerCase() : '';
+    const m = /^(?:Key|Digit)([A-Z1-9])$/.exec(e.code || '');
+    const key = /^[a-z1-9]$/.test(lower) ? lower : m ? m[1].toLowerCase() : e.key;
+    const mods = [e.ctrlKey && 'ctrl', e.altKey && 'alt', e.shiftKey && 'shift', e.metaKey && 'meta'];
+    return [...mods, key].filter(Boolean).join('+');
+  }
+
   function createClaudeHub(win) {
     let hub = null;
     const off = () => {};
@@ -33,6 +42,7 @@
         },
         can: (action) => !!standaloneFn(action),
         forwards: () => false,
+        forwardCombos: () => [],
         closeGuard() {},
         openExternal(url) {
           win.open(url, '_blank', 'noopener');
@@ -42,9 +52,9 @@
       return hub;
     }
 
-    return { connect };
+    return { connect, comboOf };
   }
 
-  if (typeof module === 'object' && module.exports) module.exports = { createClaudeHub };
+  if (typeof module === 'object' && module.exports) module.exports = { createClaudeHub, comboOf };
   else root.ClaudeHub = createClaudeHub(root);
 })(typeof window !== 'undefined' ? window : globalThis);