driggsby 0.7.0 → 0.7.1

package/dist/dev/app-policy.js

@@ -0,0 +1,78 @@
+// The security headers on every app-origin response, the service worker
+// the app origin hands out, and the policy the host page requires of its
+// frame: a copy of what Driggsby's serving host and console do for a
+// deployed app, so the preview refuses what a deployed app is refused and a
+// page that works here works once deployed. The Driggsby service is
+// canonical: change it there first, then mirror it here.
+//
+// The content security policy keeps the page's loads on its own origin
+// (another site's script, font, image, or fetch is refused), refuses frames,
+// objects, forms, and eval, and sandboxes the page as the serving host does.
+// frame-ancestors names the host page, the only page that may frame the
+// app. A file that can run script (a page, an SVG, JavaScript) also carries
+// Connection-Allowlist, which has Chrome refuse any connection the page
+// starts to anywhere else, WebRTC included. Any other file gets neither the
+// list nor script: its sandbox grants nothing, so it opens in an origin of
+// its own, as it does deployed. Never widen the list to other files; the
+// serving host sends it only where script can run.
+const SCRIPT_MEDIA_TYPES = new Set([
+    "text/html",
+    "image/svg+xml",
+    "text/javascript",
+    "application/javascript",
+]);
+const POLICY_DIRECTIVES = [
+    "default-src 'self'",
+    "script-src 'self' 'unsafe-inline'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data: blob:",
+    "font-src 'self' data:",
+    "connect-src 'self'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "form-action 'none'",
+    "base-uri 'none'",
+];
+// What the host page requires of every document its frame shows (the
+// iframe's csp attribute), as the console does: it binds even a document
+// that doesn't come from this server.
+export const FRAME_POLICY = POLICY_DIRECTIVES.join("; ");
+// The only service worker either preview origin hands out, verbatim from
+// the serving host. An app's own worker could answer the frame's
+// navigations with documents it builds, carrying none of these headers, and
+// on these fixed ports it would outlive the preview and answer the next
+// app's too; a worker some other local server once left on the host port
+// would answer the host page, which runs tools. This one listens for
+// nothing.
+export const INERT_SERVICE_WORKER = `// This origin's only service worker. It listens for nothing, so it answers
+// no request: every page and file comes from the network with the host's
+// own headers. It behaves like any default worker: it waits until no page
+// is using the worker before it, then takes over.
+`;
+// hostOrigin is empty until the host server has bound (a startup race
+// measured in milliseconds); until then nothing may frame the app.
+export function appResponseHeaders(hostOrigin, contentType) {
+    const mediaType = (contentType.split(";")[0] ?? "").trim().toLowerCase();
+    const runsScript = SCRIPT_MEDIA_TYPES.has(mediaType);
+    const directives = [
+        runsScript ? "sandbox allow-scripts allow-same-origin" : "sandbox",
+        ...POLICY_DIRECTIVES,
+        `frame-ancestors ${hostOrigin === "" ? "'none'" : hostOrigin}`,
+    ];
+    const headers = {
+        "Content-Security-Policy": directives.join("; "),
+        // The served content types are final; the browser never guesses.
+        "X-Content-Type-Options": "nosniff",
+        "Referrer-Policy": "no-referrer",
+        "Cross-Origin-Resource-Policy": "same-origin",
+        "Cross-Origin-Opener-Policy": "same-origin",
+        "Permissions-Policy": "camera=(), microphone=(), geolocation=(), payment=()",
+    };
+    if (hostOrigin !== "") {
+        headers["Allow-CSP-From"] = hostOrigin;
+    }
+    if (runsScript) {
+        headers["Connection-Allowlist"] = "(response-origin)";
+    }
+    return headers;
+}

package/dist/dev/dev-servers.js

@@ -5,6 +5,7 @@
 // only. The app token never appears here — the broker callback holds it in
 // the CLI process.
 import { createServer } from "node:http";
+import { appResponseHeaders, INERT_SERVICE_WORKER } from "./app-policy.js";
 import { DEV_IDENTITY_PATH } from "./dev-state.js";
 import { hostPageHtml, HOST_PAGE_JS } from "./host-page.js";
 import { serveStaticFile } from "./static-files.js";
@@ -15,13 +16,16 @@ import { APP_TOOL_ALLOWLIST } from "./tool-allowlist.js";
 export const GENERIC_TOOL_TROUBLE = "We couldn't run that just now. Try again in a moment.";
 export const TOOL_NOT_ALLOWED_MESSAGE = "That tool isn't available to Driggsby apps. Apps can use read-only tools like get_overview and list_accounts.";
 const MAX_TOOL_CALL_BODY_BYTES = 65_536;
+const PLAIN_TEXT = "text/plain; charset=utf-8";
+const JAVASCRIPT = "text/javascript; charset=utf-8";
 export async function startDevServers(options) {
     // Both origins bind and advertise 127.0.0.1: advertising "localhost"
     // while binding only the IPv4 loopback breaks on machines whose browser
     // resolves localhost to ::1 first.
     let appPortForGuard = 0;
-    // Filled in once the host server binds; app responses embed it in their
-    // frame-ancestors policy so only the real host page can frame the app.
+    // Filled in once the host server binds; app responses name it in their
+    // frame-ancestors and Allow-CSP-From, so only the real host page can
+    // frame the app.
     let hostOriginForFraming = "";
     const appServer = createServer((request, response) => {
         void handleAppRequest(options, appPortForGuard, hostOriginForFraming, request, response);
@@ -70,39 +74,41 @@ export async function startDevServers(options) {
 // The app origin: the SDK path, then the project's own files.
 // ---------------------------------------------------------------------------
 async function handleAppRequest(options, appPort, hostOrigin, request, response) {
-    // Only the real host page may frame the app: without this, any other
-    // loopback-served page could embed the app origin, pin itself as the
-    // app's host, and feed it fabricated numbers. Until the host server has
-    // bound (a startup race measured in milliseconds), nothing may frame it.
-    // nosniff keeps the browser honest about the served content types.
-    const appHeaders = {
-        "Content-Security-Policy": `frame-ancestors ${hostOrigin === "" ? "'none'" : hostOrigin};`,
-        "X-Content-Type-Options": "nosniff",
-    };
+    // Every response carries the deployed app's headers (app-policy.ts). Their
+    // frame-ancestors lets only the real host page frame the app: without it,
+    // any other loopback-served page could embed the app origin, pin itself
+    // as the app's host, and feed it fabricated numbers.
+    const plainTextHeaders = appResponseHeaders(hostOrigin, PLAIN_TEXT);
     // Same rebinding guard as the host origin: a page on another site that
     // tricked DNS into pointing here carries its own Host, and fails.
     if (!hostHeaderIsLocal(request.headers.host, appPort)) {
-        sendText(response, 403, "text/plain; charset=utf-8", "Forbidden.", appHeaders);
+        sendText(response, 403, PLAIN_TEXT, "Forbidden.", plainTextHeaders);
+        return;
+    }
+    // Every service worker script request, whatever path it names, gets the
+    // inert worker (app-policy.ts), as deployed. Browsers mark each one.
+    if (isServiceWorkerScriptRequest(request)) {
+        sendText(response, 200, JAVASCRIPT, INERT_SERVICE_WORKER, appResponseHeaders(hostOrigin, JAVASCRIPT));
         return;
     }
     const path = requestPath(request);
     if (request.method !== "GET" && request.method !== "HEAD") {
-        sendText(response, 405, "text/plain; charset=utf-8", "Method not allowed.", appHeaders);
+        sendText(response, 405, PLAIN_TEXT, "Method not allowed.", plainTextHeaders);
         return;
     }
     if (path === "/-/driggsby-sdk.js") {
-        sendText(response, 200, "text/javascript; charset=utf-8", options.sdkBundle, appHeaders);
+        sendText(response, 200, JAVASCRIPT, options.sdkBundle, appResponseHeaders(hostOrigin, JAVASCRIPT));
         return;
     }
     const file = await serveStaticFile(options.serveDirectory, path);
     if (file === null) {
-        sendText(response, 404, "text/plain; charset=utf-8", "Not found.", appHeaders);
+        sendText(response, 404, PLAIN_TEXT, "Not found.", plainTextHeaders);
         return;
     }
     response.writeHead(file.status, {
         "Content-Type": file.contentType,
         "Cache-Control": "no-store",
-        ...appHeaders,
+        ...appResponseHeaders(hostOrigin, file.contentType),
     });
     response.end(file.body);
 }
@@ -117,6 +123,12 @@ async function handleHostRequest(options, hostPort, appOrigin, sseClients, reque
         sendJson(response, 403, { ok: false, error: { message: "Forbidden." } });
         return;
     }
+    // The host page registers no worker, so a worker script request here is
+    // a foreign one; the inert worker replaces it (app-policy.ts).
+    if (isServiceWorkerScriptRequest(request)) {
+        sendText(response, 200, JAVASCRIPT, INERT_SERVICE_WORKER);
+        return;
+    }
     const path = requestPath(request);
     if (request.method === "GET" && path === DEV_IDENTITY_PATH) {
         // Lets `dev --stop` (and `dev`) confirm that a record in ~/.driggsby
@@ -129,7 +141,7 @@ async function handleHostRequest(options, hostPort, appOrigin, sseClients, reque
         return;
     }
     if (request.method === "GET" && path === "/host.js") {
-        sendText(response, 200, "text/javascript; charset=utf-8", HOST_PAGE_JS);
+        sendText(response, 200, JAVASCRIPT, HOST_PAGE_JS);
         return;
     }
     if (request.method === "GET" && path === "/events") {
@@ -150,7 +162,7 @@ async function handleHostRequest(options, hostPort, appOrigin, sseClients, reque
         await handleToolCall(options, hostPort, request, response);
         return;
     }
-    sendText(response, 404, "text/plain; charset=utf-8", "Not found.");
+    sendText(response, 404, PLAIN_TEXT, "Not found.");
     return;
 }
 async function handleToolCall(options, hostPort, request, response) {
@@ -209,6 +221,9 @@ function requestPath(request) {
     const queryStart = url.indexOf("?");
     return queryStart === -1 ? url : url.slice(0, queryStart);
 }
+function isServiceWorkerScriptRequest(request) {
+    return request.headers["service-worker"] === "script" || request.headers["sec-fetch-dest"] === "serviceworker";
+}
 function hostHeaderIsLocal(host, port) {
     return host === `localhost:${String(port)}` || host === `127.0.0.1:${String(port)}`;
 }

package/dist/dev/host-page.js

@@ -5,6 +5,7 @@
 // inside Driggsby. The page carries no token and no data; every tool call
 // goes to the CLI's own /tool-calls endpoint, which holds the token and
 // enforces the allowlist and bounds.
+import { FRAME_POLICY } from "./app-policy.js";
 // The page's script is served as its own file so the page can carry a
 // Content-Security-Policy with no inline scripts.
 //
@@ -14,7 +15,11 @@
 // `appOrigin` is built by startDevServers from a literal plus a bound port
 // number, and `background` has passed readProjectConfig's strict hex-color
 // rule (or is null). Anything looser than those sources must not be
-// passed here.
+// passed here. FRAME_POLICY is a constant with no double quote in it.
+//
+// The frame gets the console's sandbox and, as its csp attribute, the
+// deployed policy (app-policy.ts), which Chrome then requires of every
+// document the frame shows, even one this server didn't send.
 export function hostPageHtml(slug, appOrigin, background) {
     return `<!doctype html>
 <html lang="en" data-app-origin="${appOrigin}">
@@ -84,7 +89,7 @@ export function hostPageHtml(slug, appOrigin, background) {
     <span class="slug">${slug}</span>
     <span class="mode">driggsby dev — your live data</span>
   </header>
-  <iframe id="app" src="${appOrigin}/" sandbox="allow-scripts allow-same-origin allow-forms"></iframe>
+  <iframe id="app" src="${appOrigin}/" sandbox="allow-scripts allow-same-origin" csp="${FRAME_POLICY}"></iframe>
   <script type="module" src="/host.js"></script>
 </body>
 </html>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driggsby",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Set up and build on Driggsby, the MCP server for personal finance.",
   "license": "Apache-2.0",
   "repository": {
@@ -28,7 +28,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@driggsby/deploy": "0.7.0",
-    "@driggsby/sdk": "0.7.0"
+    "@driggsby/deploy": "0.7.1",
+    "@driggsby/sdk": "0.7.1"
   }
 }