gitnexushub 0.4.1 → 0.4.2

package/hooks/gitnexus-enterprise-hook.cjs

@@ -20,11 +20,45 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const crypto = require('crypto');
 const http = require('http');
 const https = require('https');
 const { spawnSync } = require('child_process');
 const { URL } = require('url');
 
+/**
+ * Device fingerprint — stable per-machine identity the hub uses to bind
+ * device-scoped tokens. MUST match the algorithm in
+ * gitnexus-connect/src/fingerprint.ts (same SHA-256 of
+ * `hostname:username:platform:arch`, truncated to 16 hex chars) so the
+ * hook's requests share the same identity as `gnx connect`'s.
+ *
+ * Reimplemented inline here because the hook is a dependency-free .cjs
+ * and cannot import from the compiled connect bundle.
+ */
+function computeFingerprint() {
+  const identity = `${os.hostname()}:${os.userInfo().username}:${os.platform()}:${os.arch()}`;
+  return crypto.createHash('sha256').update(identity).digest('hex').slice(0, 16);
+}
+
+function getDeviceName() {
+  return `${os.userInfo().username}@${os.hostname()}`;
+}
+
+/**
+ * Build the header bag the hub's auth middleware requires. Device tokens
+ * (issued by `gnx connect`) are rejected without both `X-Device-Fingerprint`
+ * and `X-Device-Name` — omitting them surfaces as a 403 and the hook would
+ * silently bail, so every call must go through this helper.
+ */
+function authHeaders(config) {
+  return {
+    Authorization: `Bearer ${config.hubToken}`,
+    'X-Device-Fingerprint': computeFingerprint(),
+    'X-Device-Name': getDeviceName(),
+  };
+}
+
 const HOOK_TIMEOUT_MS = 1500;
 const CONFIG_PATH = path.join(os.homedir(), '.gitnexus', 'config.json');
 const REGISTRY_PATH = path.join(os.homedir(), '.gitnexus', 'connect-registry.json');
@@ -298,7 +332,7 @@ async function handlePreToolUse(input, config, entry) {
 
   const res = await httpPostJson(
     `${config.hubUrl}/api/repos/${entry.hubRepoId}/augment`,
-    { Authorization: `Bearer ${config.hubToken}` },
+    authHeaders(config),
     { pattern },
   );
   if (!res || res.status !== 200 || !res.body || !res.body.text) return;
@@ -360,9 +394,10 @@ async function handlePostToolUse(input, config, entry) {
 
   let meta = readMetaCache(entry.hubRepoId);
   if (!meta) {
-    const res = await httpGetJson(`${config.hubUrl}/api/repos/${entry.hubRepoId}/meta`, {
-      Authorization: `Bearer ${config.hubToken}`,
-    });
+    const res = await httpGetJson(
+      `${config.hubUrl}/api/repos/${entry.hubRepoId}/meta`,
+      authHeaders(config),
+    );
     if (!res || res.status !== 200 || !res.body) return;
     meta = res.body;
     writeMetaCache(entry.hubRepoId, meta);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexushub",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Connect your editor to GitNexus Hub — one command MCP setup + project context",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",