ghostbus 0.5.2 → 0.5.4

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.5.4 — 2026-10-11
+
+Security hardening, round 3 — hostile input: the values a malicious (or merely buggy) client controls, followed to the filesystem, the object graph, and state validation. Audit-first as usual: two of the five surfaces turned out to be already safe, and the entry says which and why rather than dressing them up as fixes.
+
+- **Shared-file name `__proto__` corrupted the file store (fixed)** — file names are keys in one plain object, and `_putFile` blocked `..` but nothing else. Writing a file named `__proto__` invoked the prototype setter on the files map: the record became the map's *prototype*, the "file" enumerated nowhere, and the store was silently corrupt (verified against 0.5.3). `constructor` had the mirror-image problem on reads (an inherited member instead of "not found"). Now: `__proto__` / `constructor` / `prototype` are refused at write ("path is a reserved name"), treated as absent at read/delete (own-property checks), and refused inside snapshots. Names that merely look like paths (`/abs/looking.txt`, backslashes, a NUL byte) remain what they always were — inert state keys, never filesystem paths; the suite proves nothing but the one store file appears on disk.
+- **Snapshot validation deepened from shape to usability** (`validateSnapshot` in `src/core.mjs`) — a snapshot is untrusted input (hosted import, CLI import, restore), and the old check waved through states that then crashed the bus on first use: `agents: [null]` passed and bricked every subsequent operation with a TypeError, a file with non-string `text` passed and broke search/sizing, negative seq counters passed. Now entries must be objects, agents need string names, files need string text, counters must be finite and non-negative, context must be an object or null, and counts have sanity caps far above anything the bus itself can produce (stored messages trim at 10k, events at 5k; caps are 10k agents/files, 100k messages/tasks/events). Compatibility is a hard constraint and is tested: real exports produced by the current code import cleanly (hosted round trip + core restore), as they did from v0.5.0–v0.5.3 shapes. Unknown *extra* top-level keys stay allowed — rejecting them would break forward compatibility for no safety gain; every known key is typed.
+- **Workspace ids validated at every boundary (defense in depth)** — create and import already enforced `^[a-z0-9][a-z0-9-]{1,62}$` and the routes are regex-bound, so remote traversal was already refused; the thin spot was the registry *file*: `getWorkspace` trusted its keys blindly, and a planted or hand-edited entry like `../escape` made the admin list load (and the bus write) a state file **outside** the data dir. The registry is now filtered through the id rule at load (invalid entries are ignored, with a one-time stderr warning per id), and workspace resolution re-checks the id before it can become a path.
+- **Channel named `__proto__` was dropped from channel counts (fixed)** — `_listChannels` accumulated into a plain `{}`; reads of the `__proto__` key hit the prototype and the count never landed. The accumulator is a null-prototype object now; the channel counts like any other.
+- **Prototype pollution: audited, not reachable — now pinned by canaries.** State enters only through `JSON.parse`, the core's JSON round-trip clone, and object spread — all own-property semantics — and a full-codebase hunt found no recursive merge and no `Object.assign` of caller data (the remaining `Object.assign` uses build Error objects from literals). Canary checks now attempt pollution through the context writer and through restore payloads (nested `__proto__` in workspace and context) and assert `Object.prototype` stays clean. The board page was audited in the same pass: every interpolated value already goes through its `esc()` helper, and the workspace name renders via `textContent`.
+- **Audit-log injection: audited, safe.** The v0.5.3 admin audit line is a single `JSON.stringify` of a fixed-shape record (timestamp, action literal, validated workspace id, socket IP); JSON encoding escapes any control characters, and no other user-controlled string (workspace names included) reaches the line.
+- **Tests** — five new checks (59 in the main suite, was 54): reserved file names + inert path-like names (with an on-disk assertion), deep snapshot validation + pollution canaries, `__proto__` channel counting, hosted traversal refusal at create and at import (explicit id, envelope id, and state id) with a hostile-envelope refusal and a clean legit import, and the planted-registry escape. All five fail against the 0.5.3 code (54 passed, 5 failed — each for its intended reason; in the hosted check, the id-traversal asserts already passed on 0.5.3 and the red assertion is the hostile envelope importing with 201) and pass with the change; serverless stays 6/6 and both demos green.
+- **Scope boundary, honestly** — what did NOT change: no API changes; no behavior change for legitimate names, ids, or exports; the single relay's store path is still operator-supplied (argv/env) and out of the remote-input surface; the serverless pack's registry lives in a KV store where ids are opaque keys, not paths — its ids still enter only through the same validated creation, and the core fixes (reserved file names, deep snapshot validation where it applies, channel counts) flow to it through the shared core. The networked multi-writer store is still future work.
+
+## 0.5.3 — 2026-10-11
+
+Security hardening, round 2 — the layer under the v0.5.2 defaults. v0.5.2 made enforcement the default; this round removes the sharp edges an attacker could still lean on: non-timing-safe secret compares, unthrottled key guessing at the hosted layer, unbounded request bodies, framable HTML pages, world-readable data files, and internal error text leaking to clients.
+
+- **Timing-safe secret comparisons everywhere** — the hosted router compared workspace keys with `sha256(given) === meta.keyHash` (plain `===` on a digest), and the core compared agent-token hashes the same way. Both now use `crypto.timingSafeEqual` over the digests (new exported `hashMatches` in `src/handler.mjs`, shared by the router, the core token check, and the serverless pack, whose `wsKeyOk` had the same plain compare). A full-codebase audit found no other secret comparisons.
+- **Failed-auth throttle at the hosted layer** (`src/hosted-server.mjs`) — the handler's 300 req/min limiter only throttles traffic already inside a workspace; nothing slowed down guessing admin or workspace keys. Now: 30 failed auth attempts per minute per IP → `429` on the admin surface and on workspace routes until the window rolls. Successful auth never counts; `/health` and `/probe` stay open so an operator can watch an attack happen.
+- **Request bodies capped at 1 MB** (`readJsonBody` in `src/handler.mjs`) — both body readers accumulated without a cap (past a 5 MB socket-destroy with no useful response). One shared reader now enforces a commented `MAX_BODY_BYTES = 1_000_000` on hosted admin routes, in-workspace routes, and the single relay; over the cap the client gets a clean `413` JSON error and the socket is dropped after the response. File contents travel as JSON in GhostBus, so legitimate traffic fits comfortably; a workspace *import* over 1 MB must be restored from a state file / the CLI instead of over HTTP (stated in `docs/hosted.md`).
+- **HTML pages carry frame/CSP protection** — the board (`src/handler.mjs`) and the hosted landing page are served with `X-Frame-Options: DENY` and a `Content-Security-Policy`: `default-src 'self'`, `frame-ancestors 'none'`, `object-src 'none'`. Both pages are single self-contained documents (inline script/style, same-origin fetches, zero external resources), so the CSP allows `'unsafe-inline'` for script/style specifically — no eval, no external origins.
+- **Data files are written 0600** — the registry and workspace state files hold every key/token hash; `FileStore.save` (core, so the single relay benefits too) and `saveRegistry` plus the hosted import write now create their temp files with mode 0600 (plus a chmod before the atomic rename), and the mode rides through the rename. Existing files tighten on their next save.
+- **Error hygiene** — the single relay and the hosted server returned raw `e.message` in 500s. Both now log the real error (with stack) to stderr and answer a generic `{ error: 'internal error' }`. The handler's 400s are unchanged on purpose: those are deliberate, client-facing validation/auth errors thrown by the core, not internal faults.
+- **Admin audit log** (`src/hosted-server.mjs`) — every admin action (workspace create, delete, rotate-key, export, import) emits one structured stderr line: timestamp, action, workspace id, source IP. Never a key, never a hash. On a paid host, that stderr stream is the operator's audit trail.
+- **SECURITY.md** — new at the repo root: latest-release-only support, private reporting to gdev6145@gmail.com, one-business-day acknowledgement (the studio's stated support posture), and scope notes.
+- **Tests** — three new checks (54 in the main suite, was 51): HTML headers + 0600 file modes + audit lines (create/rotate/delete, asserting no key material appears in stderr); the 1 MB cap returning 413 on hosted-admin, in-workspace, and single-relay routes; and the failed-auth throttle (30 bad keys → 401 each, then even the correct key → 429, admin too, health still 200). All three fail against the 0.5.2 servers (51 passed, 3 failed, each for its intended reason) and pass with the change; serverless stays 6/6 and both demos green. The timing-safe change is covered functionally by the existing right-key/wrong-key checks at every layer — a timing side channel is not observable from a functional test, so that one is verified by the audit above rather than a red/green run.
+- **Scope boundary, honestly** — what did NOT change: no API or behavior change for legitimate clients; storage format and locations; the local stdio/CLI trust model; the serverless pack's opt-in token posture (only its key compare was aligned); the deferred networked multi-writer store is still future work. One judgment call to know about: throttling is per-IP and in-memory — behind a shared NAT, one guesser can 429 a whole office's *unauthenticated* attempts for a minute; authenticated traffic with a valid key is only blocked while the throttle is tripped, and the window is short by design.
+
 ## 0.5.2 — 2026-10-11
 
 Security hardening — the pre-pilot pass. A cold source review scored GhostBus 7.4/10 with security maturity its lowest mark (5.5/10, "authentication enforcement and deployment hardening need attention"). That was the right call to answer before any hosted workspace carries a stranger's work — or their money:

package/README.md

@@ -23,7 +23,7 @@ Built and in use: 29 MCP tools across presence, messages, tasks, a shared worksp
 ```bash
 git clone https://github.com/littlestjames82-sys/ghostbus.git ghostbus && cd ghostbus
 node examples/two-agent-demo.mjs   # watch a planner and a builder cooperate
-node test.mjs                      # 51 checks: core, tokens, capsules, dependencies, sync, persistence, concurrency, MCP stdio, HTTP, SSE, CLI, hosted security
+node test.mjs                      # 59 checks: core, tokens, capsules, dependencies, sync, persistence, concurrency, MCP stdio, HTTP, SSE, CLI, hosted security, hostile input
 node examples/three-agent-team.mjs # planner + builder + reviewer, no human relaying
 ```
 

package/docs/hosted.md

@@ -106,6 +106,65 @@ the operator, so its defaults are stricter than the local relay's (v0.5.2):
   Drill a restore (delete + import) before you need one; a restore lands in
   the workspace's provenance log as `workspace.restore`.
 
+Round 2 (v0.5.3) closed the next layer:
+
+- **Timing-safe secret comparisons everywhere.** Workspace keys (hosted
+  router + serverless pack) and per-agent tokens (core) are compared with
+  `crypto.timingSafeEqual` over SHA-256 digests — no `===` on secrets
+  anywhere in the codebase.
+- **Failed-auth throttling at the hosted layer.** The in-workspace limiter
+  (300 req/min/IP) never covered *guessing*: 30 failed auth attempts per
+  minute from one IP now gets 429s on the admin surface and on workspace
+  routes until the window rolls. Successful auth never counts toward it;
+  `/health` and `/probe` stay open so operators can see an attack.
+- **Request bodies are capped at 1 MB** on every JSON route (hosted admin,
+  in-workspace, single relay). Over the cap: a clean `413` JSON error.
+  File contents travel as JSON in GhostBus, so legitimate files fit
+  comfortably — but a workspace *import* larger than 1 MB must be restored
+  by placing the state file in the data dir (or via the CLI), not over HTTP.
+- **HTML pages can't be framed and carry a CSP.** The board and the hosted
+  landing page answer with `X-Frame-Options: DENY` and a
+  `Content-Security-Policy` (`default-src 'self'`, `frame-ancestors 'none'`;
+  inline script/style are allowed specifically because both pages are
+  single self-contained documents with zero external resources).
+- **Data files are written owner-only (0600).** The registry and every
+  workspace state file hold key/token hashes; they are created 0600 through
+  the same atomic temp+rename writes as before.
+- **Admin actions are audit-logged.** Every workspace create, delete,
+  rotate-key, export, and import writes one structured stderr line
+  (timestamp, action, workspace id, source IP) — never a key or a hash.
+  Point the hosted process's stderr at your log collector and that *is*
+  the operator audit trail.
+- **Reporting a vulnerability:** see `SECURITY.md` at the repo root
+  (private email reporting, one-business-day acknowledgement).
+
+Round 3 (v0.5.4) hardened the input surface — values a hostile or buggy
+client controls, followed to the filesystem, the object graph, and state
+validation:
+
+- **Workspace ids are validated at every boundary.** Create and import
+  require `^[a-z0-9][a-z0-9-]{1,62}$`, the workspace routes only match that
+  shape, workspace resolution re-checks it, and the registry file itself is
+  filtered through the same rule when loaded — a planted or hand-edited
+  registry entry can never turn an id into a path outside the data dir.
+- **Shared-file names are state keys, never paths.** A name that merely
+  looks like a path is stored and returned as an inert key. The three names
+  that are special to a JavaScript object — `__proto__`, `constructor`,
+  `prototype` — are refused at write, treated as absent at read, and refused
+  inside snapshots (before v0.5.4, writing a file named `__proto__`
+  silently corrupted the workspace's file map).
+- **Snapshots and imports are deeply validated.** Collection entries must
+  be usable objects (agents need string names, files need string text),
+  counters must be finite and non-negative, and counts carry sanity caps
+  far above anything the bus itself produces. Every export made by
+  v0.5.0–v0.5.3 still imports — compatibility is covered by tests, not
+  assumed.
+- **Prototype pollution is not reachable.** State enters only through
+  `JSON.parse`, JSON round-trip cloning, and spread (all own-property
+  semantics); there is no recursive merge of caller data anywhere in the
+  codebase, and the suite carries canary checks that try anyway through
+  the context writer and restore payloads.
+
 ## Option B — serverless on Netlify (Blobs)
 
 `deploy/netlify/` contains a Netlify Function implementing the same multi-workspace semantics over Netlify Blobs (strong consistency):

package/package.json

@@ -44,5 +44,5 @@
     "hosted": "node src/hosted-server.mjs"
   },
   "type": "module",
-  "version": "0.5.2"
+  "version": "0.5.4"
 }

package/src/core.mjs

@@ -14,10 +14,25 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-export const GHOSTBUS_VERSION = '0.5.2';
+export const GHOSTBUS_VERSION = '0.5.4';
 const sha256 = (s) => crypto.createHash('sha256').update(String(s)).digest('hex');
+// Timing-safe equality for hex digests (v0.5.3): secret comparisons must not
+// short-circuit on the first differing character the way === does.
+const hashEqHex = (aHex, bHex) => {
+  const a = Buffer.from(String(aHex)); const b = Buffer.from(String(bHex));
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+};
 export const TASK_STATUSES = ['queued', 'claimed', 'needs-approval', 'done', 'cancelled'];
 const CLAIM_LEASE_MS = 15 * 60 * 1000;
+// Shared-file names are keys in one plain object, never filesystem paths —
+// but three names are special to the object itself (v0.5.4): assigning
+// files['__proto__'] invokes the prototype setter and silently replaces the
+// map's prototype (the "file" then enumerates nowhere and the store is
+// corrupted), while reading files['constructor'] / files['__proto__'] on a
+// fresh map returns inherited members instead of "not found". Writes refuse
+// the three outright; reads treat them as absent; snapshots may not carry
+// them either (validateSnapshot below).
+const RESERVED_FILE_NAMES = new Set(['__proto__', 'constructor', 'prototype']);
 
 const now = () => new Date().toISOString();
 const clone = (v) => JSON.parse(JSON.stringify(v));
@@ -62,7 +77,11 @@ export class FileStore {
       await fs.promises.mkdir(path.dirname(this.file), { recursive: true });
       const tmp = this.file + '.tmp.' + process.pid + '.' + Math.random().toString(36).slice(2, 10);
       try {
-        await fs.promises.writeFile(tmp, JSON.stringify(state, null, 2));
+        // State files hold token hashes — owner-only (0600) from birth
+        // (v0.5.3). The mode rides through the atomic rename; the chmod
+        // covers filesystems/umasks that would otherwise widen it.
+        await fs.promises.writeFile(tmp, JSON.stringify(state, null, 2), { mode: 0o600 });
+        await fs.promises.chmod(tmp, 0o600).catch(() => {});
         await fs.promises.rename(tmp, this.file); // atomic replace
       } finally {
         await fs.promises.unlink(tmp).catch(() => {});
@@ -160,7 +179,7 @@ export class GhostBus {
     const a = this._agent(name);
     if (!a) throw Object.assign(new Error(`agent not registered: ${name}`), { code: 'UNKNOWN_AGENT' });
     if (this.requireTokens && a.tokenHash) {
-      if (!token || sha256(token) !== a.tokenHash) {
+      if (!token || !hashEqHex(sha256(token), a.tokenHash)) {
         throw Object.assign(new Error(`agent token required or wrong for: ${name}`), { code: 'AGENT_AUTH' });
       }
     }
@@ -382,6 +401,7 @@ export class GhostBus {
     this._requireAgent(by, token);
     if (!p || typeof text !== 'string') throw new Error('path and text required');
     if (String(p).includes('..')) throw new Error('path may not contain ..');
+    if (RESERVED_FILE_NAMES.has(p)) throw new Error('path is a reserved name');
     const prev = this.state.files[p];
     const history = prev ? [...(prev.history || []), { text: prev.text, updatedBy: prev.updatedBy, updatedAt: prev.updatedAt }].slice(-10) : [];
     this.state.files[p] = { text, updatedBy: by, updatedAt: now(), history };
@@ -393,7 +413,7 @@ export class GhostBus {
   async getFile(...args) { return this._serialized(() => this._getFile(...args)); }
   async _getFile(p, { withHistory = false } = {}) {
     await this.init();
-    const f = this.state.files[p];
+    const f = Object.prototype.hasOwnProperty.call(this.state.files, p) ? this.state.files[p] : undefined;
     if (!f) throw new Error(`file not found: ${p}`);
     const { history, ...rest } = f;
     return { path: p, ...clone(rest), versions: (history || []).length + 1, ...(withHistory ? { history: clone(history || []) } : {}) };
@@ -402,7 +422,7 @@ export class GhostBus {
   async fileHistory(...args) { return this._serialized(() => this._fileHistory(...args)); }
   async _fileHistory(p) {
     await this.init();
-    const f = this.state.files[p];
+    const f = Object.prototype.hasOwnProperty.call(this.state.files, p) ? this.state.files[p] : undefined;
     if (!f) throw new Error(`file not found: ${p}`);
     return { path: p, current: { text: f.text, updatedBy: f.updatedBy, updatedAt: f.updatedAt }, history: clone(f.history || []) };
   }
@@ -451,7 +471,7 @@ export class GhostBus {
   async _deleteFile({ by, path: p, token = null }) {
     await this.init();
     this._requireAgent(by, token);
-    if (!this.state.files[p]) throw new Error(`file not found: ${p}`);
+    if (!Object.prototype.hasOwnProperty.call(this.state.files, p)) throw new Error(`file not found: ${p}`);
     delete this.state.files[p];
     this._event('file.delete', by, `${by} deleted ${p}`);
     await this._save();
@@ -461,7 +481,9 @@ export class GhostBus {
   async listChannels(...args) { return this._serialized(() => this._listChannels(...args)); }
   async _listChannels() {
     await this.init();
-    const counts = {};
+    // Channel names are attacker-chosen strings; a null-prototype map counts
+    // '__proto__' like any other channel instead of dropping it (v0.5.4).
+    const counts = Object.create(null);
     for (const m of this.state.messages) counts[m.channel] = (counts[m.channel] || 0) + 1;
     return Object.entries(counts).map(([channel, messages]) => ({ channel, messages })).sort((a, b) => b.messages - a.messages);
   }
@@ -628,13 +650,46 @@ export class GhostBus {
 }
 
 /** Shape-check a candidate workspace snapshot. Returns null when valid,
- *  otherwise a short description of the first problem found. */
+ *  otherwise a short description of the first problem found.
+ *
+ *  v0.5.4 deepened this from "the collections exist" to "the collections are
+ *  usable": a snapshot is untrusted input (hosted import, CLI import,
+ *  restore), and the shallow check waved through states that then crashed
+ *  the bus on first use — agents:[null] (agent lookups destructure entries),
+ *  a file whose text is not a string (search/sizing throw), a negative seq
+ *  counter, a '__proto__' file name (see RESERVED_FILE_NAMES). Entries must
+ *  be objects, agents need string names (they are lookup keys), files need
+ *  string text, counters must be finite and non-negative, and counts get
+ *  sanity caps set far above anything the bus itself can produce (stored
+ *  messages trim at 10k, events at 5k), so every export made by v0.5.0–0.5.3
+ *  still validates. Unknown EXTRA top-level keys stay allowed on purpose:
+ *  rejecting them would break forward compatibility with newer exports for
+ *  no safety gain — the known keys are all typed here. */
+const SNAPSHOT_CAPS = { agents: 10_000, messages: 100_000, tasks: 100_000, events: 100_000, files: 10_000 };
+const isStateObject = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 export function validateSnapshot(s) {
-  if (!s || typeof s !== 'object' || Array.isArray(s)) return 'not an object';
-  if (!s.workspace || typeof s.workspace !== 'object') return 'missing workspace';
-  for (const k of ['seq', 'msgSeq', 'taskSeq']) if (typeof s[k] !== 'number') return `missing numeric ${k}`;
-  for (const k of ['agents', 'messages', 'tasks', 'events']) if (!Array.isArray(s[k])) return `missing array ${k}`;
-  if (!s.files || typeof s.files !== 'object' || Array.isArray(s.files)) return 'missing files object';
+  if (!isStateObject(s)) return 'not an object';
+  if (!isStateObject(s.workspace)) return 'missing workspace';
+  if (s.workspace.id !== undefined && typeof s.workspace.id !== 'string') return 'workspace.id must be a string';
+  if (s.workspace.name !== undefined && typeof s.workspace.name !== 'string') return 'workspace.name must be a string';
+  for (const k of ['seq', 'msgSeq', 'taskSeq']) {
+    if (typeof s[k] !== 'number' || !Number.isFinite(s[k]) || s[k] < 0) return `missing numeric ${k}`;
+  }
+  for (const k of ['agents', 'messages', 'tasks', 'events']) {
+    if (!Array.isArray(s[k])) return `missing array ${k}`;
+    if (s[k].length > SNAPSHOT_CAPS[k]) return `${k} exceeds sanity cap ${SNAPSHOT_CAPS[k]}`;
+    for (const el of s[k]) if (!isStateObject(el)) return `${k} entries must be objects`;
+  }
+  for (const a of s.agents) if (typeof a.name !== 'string' || !a.name) return 'agent entries need a string name';
+  if (!isStateObject(s.files)) return 'missing files object';
+  const fileNames = Object.keys(s.files);
+  if (fileNames.length > SNAPSHOT_CAPS.files) return `files exceeds sanity cap ${SNAPSHOT_CAPS.files}`;
+  for (const name of fileNames) {
+    if (RESERVED_FILE_NAMES.has(name)) return `files may not use reserved name: ${name}`;
+    const f = s.files[name];
+    if (!isStateObject(f) || typeof f.text !== 'string') return `file ${name} must be an object with string text`;
+  }
+  if (s.context !== undefined && s.context !== null && !isStateObject(s.context)) return 'context must be an object or null';
   return null;
 }
 

package/src/handler.mjs

@@ -24,6 +24,56 @@ const hashEq = (given, expected) => {
   return a.length === b.length && crypto.timingSafeEqual(a, b);
 };
 export const keyMatches = (given, expected) => !!expected && !!given && hashEq(given, expected);
+// Timing-safe check of a presented secret against a STORED sha256 hex digest
+// (v0.5.3) — the hosted router and the core token check compare against
+// hashes at rest, never against raw keys.
+export const hashMatches = (given, storedHashHex) => {
+  if (!given || !storedHashHex) return false;
+  const a = Buffer.from(crypto.createHash('sha256').update(String(given)).digest('hex'));
+  const b = Buffer.from(String(storedHashHex));
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+};
+
+// JSON request-body cap (v0.5.3): file contents travel inside JSON bodies in
+// this codebase, so 1 MB is generous for messages/tasks/files while keeping
+// a single request from exhausting memory. Over the cap the reader rejects
+// with code BODY_TOO_LARGE and the route answers 413.
+export const MAX_BODY_BYTES = 1_000_000;
+export function readJsonBody(req, limit = MAX_BODY_BYTES) {
+  return new Promise((resolve, reject) => {
+    let size = 0; let done = false;
+    const chunks = [];
+    req.on('data', (c) => {
+      if (done) return;
+      size += c.length;
+      if (size > limit) {
+        done = true;
+        req.pause(); // stop reading; the route answers 413 and drops the socket
+        reject(Object.assign(new Error(`request body too large (limit ${limit} bytes)`), { code: 'BODY_TOO_LARGE' }));
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on('end', () => {
+      if (done) return; done = true;
+      const data = Buffer.concat(chunks).toString('utf8');
+      try { resolve(data ? JSON.parse(data) : {}); } catch { resolve(null); }
+    });
+    req.on('error', () => { if (!done) { done = true; resolve(null); } });
+  });
+}
+
+// Headers for the HTML pages (board + hosted landing), v0.5.3. Both pages are
+// single self-contained documents: inline <script>/<style> and same-origin
+// fetches only, zero external resources — so the CSP allows 'unsafe-inline'
+// for script/style specifically (no eval, no external origins, no plugins)
+// and forbids framing outright.
+export const HTML_SECURITY_HEADERS = {
+  'x-frame-options': 'DENY',
+  'content-security-policy': "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'",
+};
+
+const TOO_LARGE = Symbol('body-too-large');
 
 export function createBusHandler({ id = 'default', bus, key = '' }) {
   const buckets = new Map();
@@ -51,13 +101,19 @@ export function createBusHandler({ id = 'default', bus, key = '' }) {
     if (!rateOk(req) && url.pathname !== '/health' && url.pathname !== '/probe') {
       return send(429, { error: 'rate limit: 300 requests/min per IP per workspace' });
     }
-    const readBody = () => new Promise((resolve) => {
-      let data = ''; req.on('data', c => { data += c; if (data.length > 5_000_000) req.destroy(); });
-      req.on('end', () => { try { resolve(data ? JSON.parse(data) : {}); } catch { resolve(null); } });
-    });
+    const send413 = () => {
+      try {
+        res.writeHead(413, { 'content-type': 'application/json', connection: 'close' });
+        res.end(JSON.stringify({ error: `request body too large (limit ${MAX_BODY_BYTES} bytes)` }), () => { try { req.destroy(); } catch {} });
+      } catch {}
+    };
+    const readBody = async () => {
+      try { return await readJsonBody(req); }
+      catch (e) { if (e && e.code === 'BODY_TOO_LARGE') { send413(); return TOO_LARGE; } throw e; }
+    };
 
     try {
-      if (req.method === 'GET' && url.pathname === '/') { res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }); return res.end(BOARD_HTML); }
+      if (req.method === 'GET' && url.pathname === '/') { res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', ...HTML_SECURITY_HEADERS }); return res.end(BOARD_HTML); }
       if (req.method === 'GET' && url.pathname === '/health') return send(200, { ok: true, server: 'ghostbus', workspace: id, version: GHOSTBUS_VERSION });
       if (req.method === 'GET' && url.pathname === '/probe') {
         const s = await bus.status();
@@ -103,6 +159,7 @@ export function createBusHandler({ id = 'default', bus, key = '' }) {
 
       if (req.method === 'POST' && url.pathname === '/mcp') {
         const msg = await readBody();
+        if (msg === TOO_LARGE) return; // 413 already sent
         if (!msg) return send(400, { error: 'invalid JSON body' });
         if (msg.method === 'tools/list') return send(200, { jsonrpc: '2.0', id: msg.id, result: { tools: TOOLS } });
         if (msg.method === 'tools/call') {
@@ -118,6 +175,7 @@ export function createBusHandler({ id = 'default', bus, key = '' }) {
       }
 
       const body = ['POST', 'PUT', 'DELETE'].includes(req.method) ? await readBody().catch(() => ({})) : {};
+      if (body === TOO_LARGE) return; // 413 already sent
       const safeBody = body && typeof body === 'object' ? body : {};
       const q = Object.fromEntries(url.searchParams);
 

package/src/hosted-server.mjs

@@ -23,13 +23,21 @@
  *   to act. GHOSTBUS_REQUIRE_TOKENS=0 is the only opt-out and starts with a
  *   loud warning. GHOSTBUS_ADMIN_KEY is required and must be at least 16
  *   characters — it is the operator root key (see docs/hosted.md).
+ * - v0.5.3: workspace-key checks are timing-safe, failed auth is throttled
+ *   per IP at this layer, JSON bodies are capped at 1 MB (413), registry +
+ *   workspace files are written 0600, HTML pages carry CSP/frame headers,
+ *   and every admin action is audit-logged to stderr (never keys/hashes).
+ * - v0.5.4: workspace ids are validated at EVERY boundary — create, import,
+ *   route matching (regex), workspace resolution, and the registry itself
+ *   when loaded: ids become file names inside the data dir, so a planted or
+ *   hand-edited registry entry must never turn one into a path outside it.
  */
 import http from 'node:http';
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { createBus, FileStore, GHOSTBUS_VERSION, validateSnapshot } from './core.mjs';
-import { createBusHandler, keyMatches } from './handler.mjs';
+import { createBusHandler, keyMatches, hashMatches, readJsonBody, MAX_BODY_BYTES, HTML_SECURITY_HEADERS } from './handler.mjs';
 
 const argv = process.argv.slice(2);
 const argVal = (flag) => { const i = argv.indexOf(flag); return i >= 0 ? argv[i + 1] : null; };
@@ -58,23 +66,44 @@ if (!REQUIRE_TOKENS) {
 
 fs.mkdirSync(dataDir, { recursive: true });
 const registryPath = path.join(dataDir, 'registry.json');
-const loadRegistry = () => { try { return JSON.parse(fs.readFileSync(registryPath, 'utf8')); } catch { return { workspaces: {} }; } };
+const validId = (id) => /^[a-z0-9][a-z0-9-]{1,62}$/.test(String(id || ''));
+const warnedRegistryIds = new Set();
+const loadRegistry = () => {
+  let reg;
+  try { reg = JSON.parse(fs.readFileSync(registryPath, 'utf8')); } catch { return { workspaces: {} }; }
+  if (!reg || typeof reg !== 'object' || !reg.workspaces || typeof reg.workspaces !== 'object') return { workspaces: {} };
+  // Defense in depth (v0.5.4): create/import validate ids, but the registry
+  // is also a file on disk — never let a planted or hand-edited entry turn
+  // into a path outside the data dir via getWorkspace's `${id}.json`.
+  for (const id of Object.keys(reg.workspaces)) {
+    if (!validId(id)) {
+      if (!warnedRegistryIds.has(id)) {
+        warnedRegistryIds.add(id);
+        process.stderr.write(`ghostbus hosted: ignoring registry entry with invalid workspace id ${JSON.stringify(id)} (ids become file names inside the data dir)\n`);
+      }
+      delete reg.workspaces[id];
+    }
+  }
+  return reg;
+};
 const saveRegistry = (reg) => {
   // Unique temp per save: two processes sharing this registry must never
   // collide on one fixed '.tmp' name (first rename wins, second throws ENOENT).
+  // The registry holds every workspace's key hash — owner-only (0600, v0.5.3).
   const tmp = registryPath + '.tmp.' + process.pid + '.' + Math.random().toString(36).slice(2, 10);
   try {
-    fs.writeFileSync(tmp, JSON.stringify(reg, null, 2));
+    fs.writeFileSync(tmp, JSON.stringify(reg, null, 2), { mode: 0o600 });
+    try { fs.chmodSync(tmp, 0o600); } catch { /* mode already applied on create */ }
     fs.renameSync(tmp, registryPath);
   } finally {
     try { fs.unlinkSync(tmp); } catch { /* already renamed away */ }
   }
 };
 const sha256 = (s) => crypto.createHash('sha256').update(String(s)).digest('hex');
-const validId = (id) => /^[a-z0-9][a-z0-9-]{1,62}$/.test(String(id || ''));
 
 const buses = new Map(); // id -> {bus, handle}
 async function getWorkspace(id) {
+  if (!validId(id)) return null; // an id is a file name inside dataDir — nothing else resolves (v0.5.4)
   if (buses.has(id)) return buses.get(id);
   const reg = loadRegistry();
   const meta = reg.workspaces[id];
@@ -98,9 +127,38 @@ const wsKeyOk = (req, meta) => {
   const given = req.headers['x-bus-key'] || String(req.headers.authorization || '').replace(/^Bearer\s+/i, '');
   if (!given) return false;
   if (keyMatches(given, ADMIN_KEY)) return true; // master key
-  return sha256(given) === meta.keyHash;
+  return hashMatches(given, meta.keyHash); // timing-safe vs the stored hash (v0.5.3)
+};
+
+// Failed-auth throttle (v0.5.3): the in-workspace handler limiter (300/min)
+// throttles traffic that is already inside a workspace, but nothing slowed
+// down *guessing* at the hosted layer — admin keys and workspace keys were
+// unthrottled. Track FAILED auth per IP; past the limit, admin + workspace
+// routes answer 429 until the window rolls. Successful auth never counts.
+const AUTH_FAIL_LIMIT = 30;            // failed auth attempts per window per IP
+const AUTH_FAIL_WINDOW_MS = 60_000;    // one-minute window
+const authFails = new Map(); // ip -> {start, count}
+const clientIp = (req) => (req.socket && req.socket.remoteAddress) || 'unknown';
+const authThrottled = (ip) => {
+  const b = authFails.get(ip);
+  return !!b && Date.now() - b.start <= AUTH_FAIL_WINDOW_MS && b.count >= AUTH_FAIL_LIMIT;
+};
+const noteAuthFail = (ip) => {
+  const t = Date.now();
+  let b = authFails.get(ip);
+  if (!b || t - b.start > AUTH_FAIL_WINDOW_MS) { b = { start: t, count: 0 }; authFails.set(ip, b); }
+  b.count += 1;
+};
+
+// Operator audit trail (v0.5.3): one structured stderr line per admin
+// action, so a paid host has a record of who did what to which workspace.
+// NEVER log keys or hashes — ids, actions, timestamps, source IPs only.
+const audit = (action, id, req) => {
+  process.stderr.write(JSON.stringify({ ts: new Date().toISOString(), audit: 'admin', action, workspace: id, ip: clientIp(req) }) + '\n');
 };
 
+const TOO_LARGE = Symbol('body-too-large');
+
 const LANDING = `<!doctype html><html><head><meta charset="utf-8"><title>GhostBus Hosted</title>
 <style>body{font-family:system-ui;background:#0e0c14;color:#ece8f5;margin:0;padding:40px}h1{font-size:22px}code{background:#17131f;padding:2px 7px;border-radius:6px;color:#c9b8ff}p{color:#9b8fb5;max-width:640px;line-height:1.55}</style></head>
 <body><h1>👻 GhostBus Hosted</h1>
@@ -116,19 +174,34 @@ const server = http.createServer(async (req, res) => {
   };
   res.setHeader('x-content-type-options', 'nosniff');
   res.setHeader('referrer-policy', 'no-referrer');
-  const readBody = () => new Promise((resolve) => {
-    let data = ''; req.on('data', c => { data += c; if (data.length > 5_000_000) req.destroy(); });
-    req.on('end', () => { try { resolve(data ? JSON.parse(data) : {}); } catch { resolve(null); } });
-  });
+  const ip = clientIp(req);
+  const adminDenied = () => { noteAuthFail(ip); return send(401, { error: 'admin key required' }); };
+  const readBody = async () => {
+    try { return await readJsonBody(req); }
+    catch (e) {
+      if (e && e.code === 'BODY_TOO_LARGE') {
+        try {
+          res.writeHead(413, { 'content-type': 'application/json', connection: 'close' });
+          res.end(JSON.stringify({ error: `request body too large (limit ${MAX_BODY_BYTES} bytes)` }), () => { try { req.destroy(); } catch {} });
+        } catch {}
+        return TOO_LARGE;
+      }
+      throw e;
+    }
+  };
 
   try {
-    if (req.method === 'GET' && url.pathname === '/') { res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }); return res.end(LANDING); }
+    if (req.method === 'GET' && url.pathname === '/') { res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', ...HTML_SECURITY_HEADERS }); return res.end(LANDING); }
     if (req.method === 'GET' && url.pathname === '/health') return send(200, { ok: true, server: 'ghostbus-hosted', version: GHOSTBUS_VERSION, workspaces: Object.keys(loadRegistry().workspaces).length });
 
     // ---- admin ----
+    // Failed-auth throttle (v0.5.3): sustained key guessing gets 429s on the
+    // whole admin surface before any key is even compared.
+    if (url.pathname.startsWith('/api/workspaces') && authThrottled(ip)) return send(429, { error: 'too many failed auth attempts — try again shortly' });
     if (url.pathname === '/api/workspaces' && req.method === 'POST') {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const body = await readBody();
+      if (body === TOO_LARGE) return; // 413 already sent
       if (!body) return send(400, { error: 'invalid JSON body' });
       const reg = loadRegistry();
       const id = body.id || `ws-${crypto.randomBytes(4).toString('hex')}`;
@@ -137,10 +210,11 @@ const server = http.createServer(async (req, res) => {
       const key = crypto.randomBytes(24).toString('hex');
       reg.workspaces[id] = { name: String(body.name || id).slice(0, 120), keyHash: sha256(key), createdAt: new Date().toISOString() };
       saveRegistry(reg);
+      audit('create', id, req);
       return send(201, { id, name: reg.workspaces[id].name, key, keyNote: 'Workspace key — shown ONCE, only its hash is stored. Agents use it as x-bus-key (or Bearer) under /w/' + id + '/.', board: `/w/${id}/` });
     }
     if (url.pathname === '/api/workspaces' && req.method === 'GET') {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const reg = loadRegistry();
       const out = [];
       for (const [id, meta] of Object.entries(reg.workspaces)) {
@@ -152,7 +226,7 @@ const server = http.createServer(async (req, res) => {
     }
     const rotateMatch = url.pathname.match(/^\/api\/workspaces\/([a-z0-9-]+)\/rotate-key$/);
     if (req.method === 'POST' && rotateMatch) {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const reg = loadRegistry();
       const id = rotateMatch[1];
       if (!reg.workspaces[id]) return send(404, { error: `no such workspace: ${id}` });
@@ -163,20 +237,23 @@ const server = http.createServer(async (req, res) => {
       // Refresh the cached meta so the old key dies immediately, not on restart.
       const cached = buses.get(id);
       if (cached) cached.meta = reg.workspaces[id];
+      audit('rotate-key', id, req);
       return send(200, { id, key, keyNote: 'New workspace key — shown ONCE. The previous key is invalid from this moment.', keyRotatedAt: reg.workspaces[id].keyRotatedAt });
     }
     const exportMatch = url.pathname.match(/^\/api\/workspaces\/([a-z0-9-]+)\/export$/);
     if (req.method === 'GET' && exportMatch) {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const id = exportMatch[1];
       const w = await getWorkspace(id);
       if (!w) return send(404, { error: `no such workspace: ${id}` });
       const state = await w.bus.snapshot();
+      audit('export', id, req);
       return send(200, { ghostbusExport: 1, version: GHOSTBUS_VERSION, exportedAt: new Date().toISOString(), workspace: { id, name: w.meta.name }, state });
     }
     if (url.pathname === '/api/workspaces/import' && req.method === 'POST') {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const body = await readBody();
+      if (body === TOO_LARGE) return; // 413 already sent
       if (!body) return send(400, { error: 'invalid JSON body' });
       // Accept either a full export envelope or a bare {state} / raw state.
       const env = body.ghostbusExport ? body : null;
@@ -195,15 +272,17 @@ const server = http.createServer(async (req, res) => {
       // the bus sees exactly what a restart would see.
       const file = path.join(dataDir, `${id}.json`);
       const tmp = file + '.tmp.' + process.pid + '.' + Math.random().toString(36).slice(2, 10);
-      fs.writeFileSync(tmp, JSON.stringify(state, null, 2));
+      fs.writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 0o600 }); // state file: owner-only (v0.5.3)
+      try { fs.chmodSync(tmp, 0o600); } catch { /* mode already applied on create */ }
       fs.renameSync(tmp, file);
+      audit('import', id, req);
       const w = await getWorkspace(id);
       const status = await w.bus.status();
       return send(201, { id, name, key, keyNote: 'Workspace key — shown ONCE, only its hash is stored. Imported workspaces always get a FRESH key; the source key is not carried over.', agents: status.agents, messages: status.messages, tasks: status.tasks.total, board: `/w/${id}/` });
     }
     const delMatch = url.pathname.match(/^\/api\/workspaces\/([a-z0-9-]+)$/);
     if (req.method === 'DELETE' && delMatch) {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const reg = loadRegistry();
       const id = delMatch[1];
       if (!reg.workspaces[id]) return send(404, { error: `no such workspace: ${id}` });
@@ -211,6 +290,7 @@ const server = http.createServer(async (req, res) => {
       saveRegistry(reg);
       buses.delete(id); handlers.delete(id);
       try { fs.unlinkSync(path.join(dataDir, `${id}.json`)); } catch {}
+      audit('delete', id, req);
       return send(200, { id, deleted: true });
     }
 
@@ -224,13 +304,15 @@ const server = http.createServer(async (req, res) => {
       sub.pathname = wMatch[2] || '/';
       // Open surfaces mirror the single relay: board page, health, probe.
       const open = sub.pathname === '/' || sub.pathname === '/health' || sub.pathname === '/probe';
-      if (!open && !wsKeyOk(req, w.meta)) return send(401, { error: 'missing or wrong workspace key' });
+      if (!open && authThrottled(ip)) return send(429, { error: 'too many failed auth attempts — try again shortly' });
+      if (!open && !wsKeyOk(req, w.meta)) { noteAuthFail(ip); return send(401, { error: 'missing or wrong workspace key' }); }
       return handlerFor(id, w.bus)(req, res, sub);
     }
 
     return send(404, { error: 'not found' });
   } catch (e) {
-    return send(500, { error: e.message });
+    process.stderr.write(`ghostbus hosted: internal error: ${(e && e.stack) || e}\n`);
+    return send(500, { error: 'internal error' });
   }
 });
 

package/src/http-server.mjs

@@ -30,7 +30,7 @@ const handle = createBusHandler({ id: 'default', bus, key: KEY });
 
 const server = http.createServer((req, res) => {
   const url = new URL(req.url, 'http://localhost');
-  handle(req, res, url).catch((e) => { try { res.writeHead(500, { 'content-type': 'application/json' }); res.end(JSON.stringify({ error: e.message })); } catch {} });
+  handle(req, res, url).catch((e) => { process.stderr.write(`ghostbus relay: internal error: ${(e && e.stack) || e}\n`); try { res.writeHead(500, { 'content-type': 'application/json' }); res.end(JSON.stringify({ error: 'internal error' })); } catch {} });
 });
 server.listen(port, () => {
   process.stderr.write(`ghostbus http relay v${GHOSTBUS_VERSION} · http://127.0.0.1:${port} · store=${storePath} · auth=${KEY ? 'workspace key required' : 'open (set GHOSTBUS_KEY)'}\n`);