flowviant 0.96.0 → 0.99.0

package/bin/lib/authproxy.mjs

@@ -116,6 +116,10 @@ const MAX_SOURCES = 500;
 
 const digest = (s) => createHash('sha256').update(String(s)).digest();
 
+/** An Authorization header in the Basic scheme — the only shape the gate's own
+ *  password ever arrives in, and so the only one it grades. */
+const isBasic = (v) => typeof v === 'string' && /^\s*basic(\s|$)/i.test(v);
+
 /** Constant-time over sha256 digests, so length never leaks and a missing
  *  header costs the same as a wrong one. */
 function sameSecret(a, b) {
@@ -137,7 +141,18 @@ function sameSecret(a, b) {
  * URL under attack. A single source is blocked on its own, at MAX_FAILED,
  * without ending anybody else's share.
  */
-export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId, authorizeUrl }) {
+export function startAuthProxy({
+  targetPort,
+  // The address that reaches the ATTRIBUTED socket (listeners.mjs `originFor`)
+  // — `::1` for a dev server bound to the IPv6 loopback. Defaults to the IPv4
+  // loopback it always dialled, for a caller that measured nothing.
+  targetHost = '127.0.0.1',
+  log,
+  onAbuse,
+  grantSecret,
+  shareId,
+  authorizeUrl,
+}) {
   // ALL THREE OR NONE. Two of the three is a gate that cannot bounce anybody:
   // a secret with no authorize URL has nowhere to send them, an authorize URL
   // with no secret cannot verify what comes back. An older SERVER sends none of
@@ -217,7 +232,36 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
     // whole thing down. An expired-but-validly-signed grant must never count
     // either, or a viewer who left a tab open overnight closes the share on
     // their own reload.
-    if (req.headers['authorization']) {
+    //
+    // AND ONLY A *BASIC* HEADER IS A PASSWORD ATTEMPT (audit 2026-09-24). Any
+    // Authorization header used to be graded against the gate password, so a
+    // previewed SPA calling its own `/api` with `Authorization: Bearer …` was
+    // answered 401 with a Basic challenge — over a valid grant cookie — and 25
+    // such calls blocked that viewer, eight viewers tore the share down, and
+    // the origin never saw its own header. A Bearer (or any other scheme) is
+    // the APP's credential: it is not ours to grade and it rides through.
+    //
+    // A VALID GRANT COOKIE IS ASKED FIRST, for the same reason: an app that
+    // itself speaks Basic sends a header that is not our password, and a
+    // viewer the app has vouched for must not be graded on it. A grant is
+    // HMAC-verified, so asking it first opens no brute-force path.
+    let grantVerdict = 'none';
+    if (grants) {
+      // EVERY value for our name, not the first — a duplicate must not shadow.
+      for (const raw of cookieValues(req.headers.cookie, GRANT_COOKIE)) {
+        const r = verifyGrant(raw, { secret: grantSecret, shareId });
+        if (r.ok) return 'ok';
+        if (r.reason === 'exp' && grantVerdict === 'none') {
+          lastExpired = r.payload;
+          grantVerdict = 'expired';
+        }
+      }
+      if (grantVerdict === 'none' && String(req.headers.cookie ?? '').includes(GRANT_COOKIE)) {
+        grantVerdict = 'forged';
+      }
+    }
+
+    if (isBasic(req.headers['authorization'])) {
       // A blocked source is refused BEFORE the comparison — a block that
       // still grades guesses would let the brute force run to a correct hit.
       if (sourceBlocked(req)) return 'blocked';
@@ -230,18 +274,7 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
       noteFailure(req);
       return 'badpass';
     }
-
-    if (!grants) return 'none';
-    // EVERY value for our name, not the first — a duplicate must not shadow.
-    for (const raw of cookieValues(req.headers.cookie, GRANT_COOKIE)) {
-      const r = verifyGrant(raw, { secret: grantSecret, shareId });
-      if (r.ok) return 'ok';
-      if (r.reason === 'exp') {
-        lastExpired = r.payload;
-        return 'expired';
-      }
-    }
-    return String(req.headers.cookie ?? '').includes(GRANT_COOKIE) ? 'forged' : 'none';
+    return grantVerdict;
   };
 
   /**
@@ -338,7 +371,10 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
   // its request would be us editing their app's input.
   const forwardOpts = (req) => {
     const headers = { ...req.headers };
-    delete headers.authorization;
+    // Only when it IS the gate credential. Anything else in Authorization is
+    // the previewed app's own (a Bearer to its API, its own Basic realm) and
+    // the app breaks without it; ours must still never reach branch code.
+    if (sameSecret(headers.authorization, expected)) delete headers.authorization;
     delete headers['proxy-authorization'];
     // ONLY OURS. The driver's app owns its own cookies and breaks without them;
     // our grant is a signed bearer token and must not reach branch code.
@@ -346,7 +382,7 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
     if (rest) headers.cookie = rest;
     else delete headers.cookie; // never send a bare empty `cookie:`
     return {
-      host: '127.0.0.1',
+      host: targetHost,
       port: targetPort,
       method: req.method,
       path: req.url,

package/bin/lib/childEnv.mjs

@@ -223,9 +223,41 @@ export const DEPLOY_KEEP_NAMES = [...DEPLOY_KEEP];
  * never leave the box either way; names would, and a name is enough to tell
  * somebody which credential to go looking for.
  */
+/**
+ * …AND THE DAEMON'S OWN CREDENTIALS, REDACTED AND NEVER ADMITTED (2026-09-24,
+ * the audit).
+ *
+ * The list above was written about the deploy lane, and it left out every
+ * credential the DAEMON itself runs on: the machine credential
+ * (`FLOWVIANT_MACHINE_TOKEN`, or its permanent `FLOWVIANT_FLEET` fallback on a
+ * headless box), and whatever signs the operator's CLIs and `gh` in. Those are
+ * the values a CLI turn can most easily reach — a turn inherits this process's
+ * environment, and `env` is one Bash call — and a turn trace, an answer and an
+ * artifact are all posted to the server. Redacting a value we never pass costs
+ * nothing (the `CF_*` argument above), so they join the REDACTION list only;
+ * `DEPLOY_KEEP` is untouched and `childEnv` still hands none of them to anybody.
+ *
+ * The machine credential is ALSO caught by shape in `env.mjs` (`fva_…`),
+ * because the copy that matters most is not in any environment variable at all:
+ * it is every project's `fleetToken` in `~/.flowviant/credentials.json`, plus
+ * the per-turn work/capture tokens the server mints. The names here are belt.
+ */
+const REDACT_ONLY = [
+  'CF_API_TOKEN',
+  'CF_ACCOUNT_ID',
+  'FLOWVIANT_MACHINE_TOKEN',
+  'FLOWVIANT_FLEET',
+  'ANTHROPIC_API_KEY',
+  'ANTHROPIC_AUTH_TOKEN',
+  'CLAUDE_CODE_OAUTH_TOKEN',
+  'OPENAI_API_KEY',
+  'GH_TOKEN',
+  'GITHUB_TOKEN',
+];
+
 export function processEnvSecrets() {
   const out = [];
-  for (const name of [...DEPLOY_KEEP, 'CF_API_TOKEN', 'CF_ACCOUNT_ID']) {
+  for (const name of [...DEPLOY_KEEP, ...REDACT_ONLY]) {
     const value = process.env[name];
     if (typeof value === 'string' && value) out.push({ name, value });
   }