freebuff 0.1.4 → 0.1.5

package/README.md

@@ -33,7 +33,7 @@ and keep the extracted `freebuff` binary and `tree-sitter.wasm` together.
 
 ## Why Freebuff?
 
-**Choice of leading models** — The regular CLI picker includes GLM 5.3 Flash, DeepSeek, GPT-6 Luna, MiMo 2.6 Flash, MiMo 2.6 Pro, Solar Mini 4, Solar Pro 4, Space Bunny Alpha, Gemini 3.8 Flash, and Muse Spark 1.2, with GLM 5.3 Flash selected by default.
+**Choice of leading models** — The regular CLI picker includes GLM 5.3 Flash, DeepSeek, GPT-6 Luna, MiMo 2.6 Flash, MiMo 2.6 Pro, Solar Mini 4, Solar Pro 4, Space Bunny Alpha, Gemini 3.8 Flash, and Muse Spark 1.3, with GLM 5.3 Flash selected by default.
 
 **Fast** — 5–10× speed up. 3–5× tokens per second compared to Claude, plus context gathering in seconds.
 
@@ -43,7 +43,7 @@ and keep the extracted `freebuff` binary and `tree-sitter.wasm` together.
 
 **How can it be free?** Freebuff is supported by text ads.
 
-**What models do you use?** In full mode, the regular picker includes GLM 5.3 Flash, DeepSeek V4.1 Flash, GPT-6 Luna, MiMo 2.6 Flash, MiMo 2.6 Pro, Solar Mini 4, Solar Pro 4, Space Bunny Alpha, Gemini 3.8 Flash, and Muse Spark 1.2. Space Bunny Alpha is a beta stealth model from an anonymous provider that retains prompts. Gemini 3.8 Flash requires a paid plan: without one it is listed but locked, and selecting it opens the plans page. GPT-6 Luna and MiMo 2.6 Pro are open to every full-access account. Muse Spark 1.2 has a 1M-token context and is rate limited across all users, so at busy times it queues and then answers on DeepSeek V4 Flash instead of leaving you waiting. GLM 5.3 Flash is the CLI default, and it costs no session at all, so the default is always available no matter how much you have used. Limited mode uses GLM 5.3 Flash, DeepSeek V4.1 Flash, MiMo 2.6 Flash, Solar Mini 4, and Solar Pro 4. Most models draw on your normal daily sessions rather than a separate limit; GLM 5.3 Flash, DeepSeek V4.1 Flash, MiMo 2.6 Flash, Solar Mini 4, and Solar Pro 4 are unmetered at full access. Models may still serve from a quantized (Q8_0) build.
+**What models do you use?** In full mode, the regular picker includes GLM 5.3 Flash, DeepSeek V4.1 Flash, GPT-6 Luna, MiMo 2.6 Flash, MiMo 2.6 Pro, Solar Mini 4, Solar Pro 4, Space Bunny Alpha, Gemini 3.8 Flash, and Muse Spark 1.3. Space Bunny Alpha is a beta stealth model from an anonymous provider that retains prompts. Gemini 3.8 Flash and Muse Spark 1.3 require a paid plan: without one they are listed but locked, and selecting one opens the plans page. GPT-6 Luna and MiMo 2.6 Pro are open to every full-access account. Muse Spark 1.3 has a 1M-token context and is rate limited across all users, so at busy times it queues and then answers on DeepSeek V4 Flash instead of leaving you waiting. GLM 5.3 Flash is the CLI default, and it costs no session at all, so the default is always available no matter how much you have used. Limited mode uses GLM 5.3 Flash, DeepSeek V4.1 Flash, MiMo 2.6 Flash, Solar Mini 4, and Solar Pro 4. Most models draw on your normal daily sessions rather than a separate limit; GLM 5.3 Flash, DeepSeek V4.1 Flash, MiMo 2.6 Flash, Solar Mini 4, and Solar Pro 4 are unmetered at full access. Models may still serve from a quantized (Q8_0) build.
 
 **Which countries is Freebuff available in?** All countries. Freebuff runs in "full" mode in the US, Canada, UK, EU, and other select countries, and in "limited" mode everywhere else (or while using a VPN). See [freebuff.com](https://freebuff.com) for the full list.
 

package/launcher.js

@@ -35,15 +35,51 @@ const PLATFORM_TARGET_KEYS = [
 
 const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '[::1]'])
 
+/**
+ * Registrable domains that serve release downloads. An https override must
+ * name one of these or a subdomain of one.
+ */
+const RELEASE_ORIGIN_DOMAINS = ['codebuff.com', 'freebuff.com']
+
+function isReleaseOriginHost(hostname) {
+  const host = hostname.toLowerCase()
+  return RELEASE_ORIGIN_DOMAINS.some(
+    (domain) => host === domain || host.endsWith(`.${domain}`),
+  )
+}
+
+/**
+ * A release version the launcher will put into a download URL or a file
+ * name: strict `MAJOR.MINOR.PATCH` with an optional dot-separated
+ * alphanumeric prerelease, and nothing else — no build metadata, no
+ * leading `v`, no whitespace, `/`, `..`, `%` or `?`. The version reaches
+ * `/api/releases/download/<version>/<file>` and the partial-archive path
+ * from the npm registry document or the local metadata file, and neither
+ * is a place that should be able to rewrite a URL path or escape a
+ * directory.
+ */
+const STRICT_RELEASE_VERSION =
+  /^(0|[1-9]\d{0,8})\.(0|[1-9]\d{0,8})\.(0|[1-9]\d{0,8})(?:-(?:0|[1-9]\d{0,8}|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d{0,8}|\d*[A-Za-z-][0-9A-Za-z-]*))*)?$/
+
+function isStrictReleaseVersion(version) {
+  return (
+    typeof version === 'string' &&
+    version.length <= 64 &&
+    STRICT_RELEASE_VERSION.test(version)
+  )
+}
+
 /**
  * Decide where release archives are downloaded from.
  *
  * NEXT_PUBLIC_CODEBUFF_APP_URL is read at runtime, so anyone able to set an
- * environment variable could point the launcher at a plain-http origin and
- * let a network attacker substitute the archive. The override is honoured
- * only over https, or over http on a loopback host (local release servers in
- * development and tests). Anything else is ignored with a warning and the
- * default origin is used.
+ * environment variable could point the launcher at another origin. The
+ * archive's sha256 comes from npm, not from that origin, so a substituted
+ * archive is refused either way; the origin is still held to the hosts that
+ * actually serve releases. The override is honoured only over https to a
+ * codebuff.com / freebuff.com host, or over http/https on a loopback host
+ * (local release servers in development and tests). Anything else is
+ * ignored with a warning and the default origin is used.
  */
 function resolveDownloadOrigin(configuredOrigin, { warn = () => {} } = {}) {
   if (typeof configuredOrigin !== 'string' || configuredOrigin.trim() === '') {
@@ -62,15 +98,25 @@ function resolveDownloadOrigin(configuredOrigin, { warn = () => {} } = {}) {
   }
 
   const isLocal = LOCAL_HOSTNAMES.has(parsed.hostname.toLowerCase())
+  const isHttp = parsed.protocol === 'http:' || parsed.protocol === 'https:'
+  // Only an origin: credentials or a query would ride along on every request.
+  const isBareOrigin =
+    !parsed.username && !parsed.password && !parsed.search && !parsed.hash
+  if (isHttp && isLocal && isBareOrigin) {
+    return trimmed
+  }
   if (
-    parsed.protocol === 'https:' ||
-    (parsed.protocol === 'http:' && isLocal)
+    parsed.protocol === 'https:' &&
+    isReleaseOriginHost(parsed.hostname) &&
+    isBareOrigin
   ) {
     return trimmed
   }
 
   warn(
-    `Ignoring NEXT_PUBLIC_CODEBUFF_APP_URL=${configuredOrigin}: release downloads must use https (http is allowed only for localhost). Downloading from ${DEFAULT_DOWNLOAD_ORIGIN}.`,
+    parsed.protocol === 'https:'
+      ? `Ignoring NEXT_PUBLIC_CODEBUFF_APP_URL=${parsed.protocol}//${parsed.host}: release downloads come only from codebuff.com or freebuff.com (or localhost). Downloading from ${DEFAULT_DOWNLOAD_ORIGIN}.`
+      : `Ignoring NEXT_PUBLIC_CODEBUFF_APP_URL=${parsed.protocol}//${parsed.host}: release downloads must use https (http is allowed only for localhost). Downloading from ${DEFAULT_DOWNLOAD_ORIGIN}.`,
   )
   return DEFAULT_DOWNLOAD_ORIGIN
 }
@@ -747,7 +793,7 @@ function createLauncher(productConfig) {
 
       const body = await streamToString(res)
       const packageData = JSON.parse(body)
-      if (typeof packageData.version !== 'string' || !packageData.version) {
+      if (!isStrictReleaseVersion(packageData.version)) {
         return null
       }
 
@@ -936,6 +982,9 @@ function createLauncher(productConfig) {
   }
 
   function getPartialArchivePath(version, targetKey) {
+    if (!isStrictReleaseVersion(version)) {
+      throw new Error(`Invalid release version for an archive path: ${version}`)
+    }
     return path.join(
       CONFIG.configDir,
       `.${packageName}-${version}-${targetKey}.tar.gz.part`,
@@ -1168,6 +1217,21 @@ function createLauncher(productConfig) {
   ) {
     const fileName = PLATFORM_TARGETS[targetKey]
 
+    // Before anything is built from it: the version becomes a URL path
+    // segment and part of a file name below.
+    if (!isStrictReleaseVersion(version)) {
+      const error = new Error(
+        `Refusing to download ${packageName}: ${JSON.stringify(String(version)).slice(0, 80)} is not a release version.`,
+      )
+      error.code = 'EBADVERSION'
+      error.retryable = false
+      trackUpdateFailed(error.message, 'invalid', {
+        stage: 'version_check',
+        target: targetKey,
+      })
+      throw error
+    }
+
     if (!fileName) {
       const error = new Error(
         `Unsupported platform: ${process.platform} ${process.arch}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "freebuff",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "The world's strongest free coding agent",
   "license": "MIT",
   "bin": {
@@ -41,13 +41,13 @@
     "provenance": false
   },
   "binaryChecksums": {
-    "linux-x64": "02645c1354b0f72ae3ae6c138fd34b2f74afdf4552f17008713ff2f00f4af1ef",
-    "linux-x64-baseline": "5b758c46c3fb289fbd8ae04ce42c304a91e87a20ff5eab338e17cbc03e937831",
-    "linux-arm64": "9f40b2b4d76cacaa1f0d598cdfe3a5534e8f3e787803c604319dee569e08d923",
-    "darwin-x64": "ef2e71cd81b3166d6449e04221cc547a499bef90ba07c5087783650f63c72854",
-    "darwin-x64-baseline": "0d860e9b5cfb178f989fc5c23695d1c5f2328175683f2046775d59df77259f9c",
-    "darwin-arm64": "5c40f26c55f11b3395eae3d509ebbed9ffceaf1b06b929cfc90a4860cf64ac35",
-    "win32-x64": "826dd49fd9b412aaa87f023901a16872813832b84cda0bad0d97f14eb5ab63eb",
-    "win32-x64-baseline": "588cd19c2cdbfd9d323e1b1b737ae9e802404231293a2208a66494fc8ea93e5a"
+    "linux-x64": "2c0f5b23b563830cbfb99f4fcc57e2657524f77159f2a8088b67f8279f7db3f9",
+    "linux-x64-baseline": "194b9ea6667ef7503412f4edca2d0e256cf8dc592e658bc147a46105f15aa44e",
+    "linux-arm64": "7609d2cad1055d0df2c9d73b95a10c98439eee77a78d739084af408c33d8e6b4",
+    "darwin-x64": "a1c7aa7fc361d1f5095d5c50dab409101a411b14951933c55b8f03d777600f5f",
+    "darwin-x64-baseline": "165d9077f04af2d30063d06445f0ddc2aa1feafadb034140d2f66435df4ae1c6",
+    "darwin-arm64": "2e99d58f7805c5ff8975e94ee6c31d23bfd2d0dd1094806659a1fa6c4c9c68e0",
+    "win32-x64": "ba239c2aae754927e11655cbc534c6c5dcfc3c41e6f8a8e9c4ede256acf23fc3",
+    "win32-x64-baseline": "cb1d911d296d481ffb1165bda1999c6e5633bb0d183c584fc121da2db7cf8abc"
   }
 }