cookbook-bridge 0.1.2 → 0.1.3

package/cookbook.mjs

@@ -246,7 +246,7 @@ export async function fetchHands(cfg) {
   if (res.status === 404) return { supported: false, calls: [], grants: [] };
   if (!res.ok) throw new Error(`hands ${res.status}`);
   const j = await res.json().catch(() => ({}));
-  return { supported: true, calls: j.calls ?? [], grants: j.grants ?? [] };
+  return { supported: true, calls: j.calls ?? [], grants: j.grants ?? [], awaiting: j.awaiting ?? [] };
 }
 
 /** Claim one call before running it. The server CASes on status, so two Bridges on

package/hands.mjs

@@ -97,7 +97,7 @@ function collapseHome(text, home) {
   const h = String(home ?? "").replace(/\/+$/, "");
   if (!h || h.length < 4) return text;
   const esc = h.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return text.replace(new RegExp(esc, "g"), "~");
+  return text.replace(new RegExp(esc + "(?=/|$)", "g"), "~");
 }
 
 /** Redact secrets out of anything this machine produced. Pure. */
@@ -181,7 +181,10 @@ const NEVER_READ = Object.freeze([
   /(^|\/)id_(rsa|ed25519|ecdsa|dsa)(\.pub)?$/i,
   /(^|\/)local\.json$/i,        // the Bridge Local loopback token
   /(^|\/)\.git\/config$/i,      // can carry credentials in a remote URL
-  /(^|\/)credentials?(\.[A-Za-z0-9]+)?$/i,
+  // `credentials.json` AND its dotfile spelling `.credentials.json` — the anchor
+  // used to accept only `/` before the word, so a dotfile in a granted project
+  // folder walked through the wall (ultrareview #123, bug_003).
+  /(^|[/.])credentials?(\.[A-Za-z0-9]+)?$/i,
 ]);
 
 /** Every spelling of a path this filesystem might consider the same file. */
@@ -691,6 +694,13 @@ const VERBS = {
     if (ext === ".json") {
       try { JSON.parse(content); } catch (e) { return { error: `That isn't valid JSON, so it wasn't written: ${e.message.slice(0, 120)}` }; }
     }
+    // The setup allowlist carries two TOML files (Codex). The "won't parse ⇒ not
+    // written" promise covered only JSON until ultrareview #123 (bug_008) — this is
+    // a structural check, not a full parser: unbalanced quotes/brackets, lines that
+    // are neither a table header nor `key = value`, unterminated multi-line strings.
+    if (ext === ".toml" && !tomlLooksValid(content)) {
+      return { error: "That doesn't look like valid TOML (unbalanced quotes/brackets or a malformed line), so it wasn't written." };
+    }
     if (content.includes("\0")) return { error: "Content contains a null byte." };
 
     let backup = null;
@@ -713,9 +723,15 @@ const VERBS = {
     if (!r.ok) return { error: r.error };
     const name = String(args.backup ?? "");
     if (!BACKUP_RE.test(name)) return { error: "Pass the backup filename this session created (…​.bak-chef-<timestamp>)." };
-    const backupPath = path.join(path.dirname(r.path), name);
-    if (path.basename(backupPath) !== name) return { error: "Invalid backup name." };
-    if (!fs.existsSync(backupPath)) return { error: "That backup isn't there any more." };
+    // write_file placed the backup next to the RESOLVED file (r.real), so a
+    // symlinked setup file — dotfile managers do this constantly — keeps its backup
+    // in the target directory. Look there first, then beside the symlink itself
+    // (ultrareview #123, bug_009: restore used to look only beside the symlink and
+    // report "isn't there any more" about a backup that existed).
+    const candidates = [path.join(path.dirname(r.real), name), path.join(path.dirname(r.path), name)];
+    if (candidates.some((c) => path.basename(c) !== name)) return { error: "Invalid backup name." };
+    const backupPath = candidates.find((c) => fs.existsSync(c));
+    if (!backupPath) return { error: "That backup isn't there any more." };
     try { fs.copyFileSync(backupPath, r.path); } catch (e) { return { error: `restore failed: ${e.code || e.message}` }; }
     return { path: args.path, restored_from: name };
   },
@@ -863,6 +879,46 @@ export function describeCall(call) {
     case "run": return `run ${a.template}`;
     case "doctor": return "run the setup doctor";
     case "env": return "look at what's installed";
+    // The three verbs a host must approve are the three that used to render as a
+    // bare verb name (ultrareview #123, bug_007). Say WHAT, not just which.
+    case "write_file": return `write ${a.path}${typeof a.content === "string" ? ` (${a.content.length} chars)` : ""}`;
+    case "restore_backup": return `restore ${a.path} from ${a.backup ?? "its backup"}`;
+    case "open_url": {
+      try { const u = new URL(String(a.url ?? "")); return `open ${u.host}${u.pathname === "/" ? "" : u.pathname} in your browser`; }
+      catch { return `open ${a.url ?? "a page"} in your browser`; }
+    }
     default: return String(call?.verb ?? "?");
   }
 }
+
+/**
+ * Structural TOML sanity check for write_file. Deliberately NOT a parser: it
+ * rejects the ways a distracted agent breaks a config (unbalanced quotes or
+ * brackets, an unterminated multi-line string, a line that is neither a table
+ * header nor `key = value`) and accepts anything that has that shape.
+ */
+export function tomlLooksValid(text) {
+  let multi = null; // the open multi-line string delimiter, if any
+  let depth = 0;    // open [ / { across lines (multi-line arrays and inline tables)
+  for (const raw of String(text).split(/\r?\n/)) {
+    const line = raw.trim();
+    if (multi) { if (line.includes(multi)) multi = null; continue; }
+    if (!line || line.startsWith("#")) continue;
+    if (depth > 0) {
+      for (const ch of line) { if (ch === "[" || ch === "{") depth++; else if (ch === "]" || ch === "}") depth--; if (depth < 0) return false; }
+      continue;
+    }
+    if (/^\[\[?[^\]]+\]\]?\s*(#.*)?$/.test(line)) continue;
+    const m = /^[A-Za-z0-9_\-."']+\s*=\s*(.+)$/.exec(line);
+    if (!m) return false;
+    const v = m[1].trim();
+    if (v.startsWith('"""') || v.startsWith("'''")) {
+      const q = v.slice(0, 3);
+      if (!(v.length > 3 && v.endsWith(q))) multi = q;
+      continue;
+    }
+    if (((v.match(/(?<!\\)"/g) || []).length) % 2 !== 0) return false;
+    for (const ch of v) { if (ch === "[" || ch === "{") depth++; else if (ch === "]" || ch === "}") depth--; if (depth < 0) return false; }
+  }
+  return !multi && depth === 0;
+}

package/local.mjs

@@ -352,7 +352,10 @@ export function createLocalServer(deps) {
     // picks it up immediately (no restart, so a host can close the door NOW).
     if (route === "POST /hosting") {
       const body = (await readBody(req)) ?? {};
-      const enabled = body.enabled !== false;
+      // A security toggle whose default is OFF must not fail open: an empty or
+      // malformed body used to mean "turn it on" (ultrareview #123, bug_011).
+      if (typeof body.enabled !== "boolean") return json(res, 400, { ok: false, error: "`enabled` must be true or false" });
+      const enabled = body.enabled;
       cfg.hosting = { ...(cfg.hosting ?? {}), enabled };
       try {
         saveConfigPatch((raw) => { raw.hosting = { ...(raw.hosting ?? {}), enabled }; });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cookbook-bridge",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Run your own Claude, Codex and Gemini subscriptions against your Cookbook workspaces. One approval connects every agent CLI on your machine, with a receipt for every run.",
   "type": "module",
   "bin": {