haltija 1.12.7 → 1.12.9

package/CHANGELOG.md

@@ -1,6 +1,122 @@
 # Changelog
 
-## 1.12.7 (unreleased)
+## 1.12.9 (unreleased)
+
+Remediation of a Tier 1 review that returned **BLOCK** on the already-published 1.12.7/1.12.8.
+Full report: `reviews/1.12.9-tier1-v1.12.6-to-v1.12.8.md`.
+
+### Security
+
+- **Babylon.js is pinned and integrity-checked (review B1).** The 3D preview added in 1.12.7 loaded
+  `cdn.babylonjs.com/babylon.js` — rolling latest, no pin, no SRI — into the one frame holding a
+  postMessage relay that reaches `spawn('sh','-c')` and the filesystem. The app strips CSP headers
+  globally and the iframe has no sandbox, so a CDN compromise, a bad publish, or a TLS-intercepting
+  proxy meant arbitrary code execution on the developer's machine. Shipped, ironically, in the
+  release that removed a *network*-reachable RCE. Now pinned to `v9.25.0` with `integrity` +
+  `crossorigin`, so substituted bytes cannot execute at all.
+- **The renderer relay now default-denies its sender.** It validated message *shape* only, so any
+  frame in the renderer could reach shell and filesystem. It now requires `event.source` to be a
+  known terminal iframe. This is what turned "third-party code in a preview pane" into "third-party
+  code with a shell", and it would have handed shell access to any plain `<iframe>` added later.
+- **`/ws/terminal` upgrades are restricted (review B3).** It accepted unauthenticated
+  cross-origin upgrades and volunteers `{shellId, cwd}` on connect, streaming the developer's
+  working directory and absolute file paths to any web page. It now admits: a **loopback hostname**
+  origin, an opaque/`file:` origin that presents a per-launch nonce the desktop app gives only to
+  its own terminal frame, or a request with **no `Origin` header at all** (a non-browser client — a
+  browser always sends one cross-origin).
+
+  **Stated precisely, because an earlier draft of this bullet was false in three directions and a
+  pre-publish review caught it.** What is *not* claimed: `/ws/agent` and `/ws/browser` are
+  deliberately **not** gated — the REST surface already answers any origin
+  (`Access-Control-Allow-Origin: *`), so any page can already `POST /tree` and `/eval`; gating the
+  socket alone would close nothing and would break non-browser agents, which is why an attempt to
+  do so was reverted during this release. And the `/ws/terminal` rule is not "local machine only":
+  a loopback match is **hostname-only, any port**, so a third-party script on your own
+  `localhost:3000` dev server qualifies, and an absent `Origin` is admitted from anywhere on the
+  LAN because the server binds `0.0.0.0`. **`--token` is what addresses those**, not this gate.
+- **The channel grant no longer leaks to child processes.** `HALTIJA_MACHINE_CHANNEL=1` was spread
+  into every command the terminal or an agent spawned, so a nested `bunx haltija` would start
+  treating its own stdin as an authenticated control channel.
+
+### `haltija/test` no longer mutates a browser nobody chose (#42)
+
+`resolveTestServerUrl` falls back to `http://localhost:8700` — the *shared* interactive server — and
+the only gate was a stderr warning. This project proved on itself that a warning is not a boundary:
+on 2026-09-03 our own suite adopted another project's server and called `navigate`/`click` against
+its six live tabs. We fixed our lane and left the published library adopting, and **a hazard fixed
+in your own lane but left in the library you ship is not fixed**.
+
+Mutating calls (`navigate`, `click`, `type`, `press`, `refresh`) now **throw** when no
+`HALTIJA_URL`/`HALTIJA_PORT` was set, with a message naming the remedy. Read-only calls (`status`,
+`query`, `eval`) are unaffected — reading from a shared server harms nobody, and a guard that blocks
+harmless calls gets disabled wholesale. `HALTIJA_TEST_ALLOW_SHARED=1` opts back in deliberately.
+
+**This is a behaviour change in a published API.** Anyone whose suite relied on the 8700 fallback
+for mutating calls will now get a loud error instead of silently driving whichever browser answered
+— which is the point.
+
+### Dependencies
+
+- **`tosijs-schema` was pinned to an exact `1.5.1`, four minors behind.** Surfaced by a new Tier 0
+  check (from tosijs-ui#61's finding #2: *declared ranges whose window excludes what a consumer
+  installs today*). An exact pin in a regular dependency also invites a duplicate install alongside
+  a consumer's own copy. Moved to `^1.9.0` after verifying the upgrade rather than assuming it:
+  977 unit + 125 e2e green, and every schema-derived generated artifact (`API.md`, `DOCS.md`,
+  `llms.txt`, `bin/hints.json`, `apps/mcp/src/endpoints.json`) rebuilt **byte-identical**.
+
+### Coverage and structure (the two gaps the reviews left open)
+
+- **Nothing exercised the terminal's WebSocket**, which is why a regression that broke it was
+  invisible to 977 green tests: `/terminal/command` travels over the stdio pipe and never needed
+  the socket, so commands kept working. Two guards now: a live upgrade test against a real private
+  server (raw HTTP upgrade, so it can set `Origin` — which the browser WebSocket API forbids), and
+  a wiring test asserting `main.js` actually *passes* what `buildServerEnv` can grant. The second
+  is the one that matters: the function was already tested; the defect was a caller that silently
+  dropped an argument. Both verified by mutation.
+- **The base64 Response shim existed twice and had already diverged** (only one copy had
+  `dataUrl()`). Now one source, `src/machine-response.ts`, built twice — ESM for the renderer's
+  modules, a global for `terminal.html`, which is an inline-script page with no import mechanism.
+
+### Fixes
+
+- **Window recreation was dead code (review B2).** The 1.12.7 stdout refactor tested
+  `__NEED_WINDOW__` against the *residual line buffer*; the marker always arrives newline-terminated,
+  so the check was always false and the correct one below it unreachable. Every `hj` command against
+  a windowless-but-alive desktop app hung 8s and failed.
+- **Root cause of the above: the wire protocol was implemented twice.** `main.js` hand-rolled the
+  prefixes, the line split and the parse while `src/machine-channel.ts` owned and tested them. It is
+  now a generated twin (`apps/desktop/machine-channel.js`), like `server-env.js`.
+- **Timeout layering was inverted**, so a ~30s command (`npm ci`, a slow build) reported "Timed out
+  on the machine channel" and discarded the server's real output. Each outer deadline is now
+  strictly longer than the one it wraps (server 30s → main 45s → iframe 50s), so a timeout at a
+  layer means that layer genuinely lost the answer.
+- **The desktop guard test only recognised template-literal fetches**, so
+  `fetch(getServerUrl() + '/files/read')` passed green and 410'd at runtime — the exact silent
+  breakage it exists to prevent. It now matches the call and the path independently (verified by
+  mutation), skips comments, and states its remaining line-scoped limit rather than implying none.
+- Bun's Unix-socket defect is now **filed upstream** (oven-sh/bun#41381) and mirrored in
+  `UPSTREAM.md`, per "we file, we don't fix". The stdio channel stays regardless — it is good on its
+  own merits.
+- Docs corrected: `docs/AGENTIC-IDE.md` no longer advertises two routes that now return 410;
+  `CLAUDE.md` no longer contradicts itself about whether the tabs were restored; published versions
+  are no longer marked `(unreleased)`; and the absolute "no machine-control surface on any
+  transport" claim is stated precisely, since an earlier version of it was false.
+
+## 1.12.8
+
+- **Electron discovery assumed macOS, so Linux re-downloaded Electron every run (#43).** The npx-cache
+  search looked for `Electron.app` — a macOS bundle — behind a `platform() !== 'win32'` guard, so
+  Linux took the branch and matched nothing. A populated cache was never detected: the launcher
+  printed "Electron not cached" on every run and fell back to `npx --yes electron`, putting an
+  npm-registry round-trip on the browser-readiness path. During a registry degradation on
+  2026-09-04 that became a server which never bound its port across three CI lanes.
+
+  The defect was two expressions of "what an Electron dist looks like", only one of them
+  platform-aware. The search now finds dist *directories* and lets `binaryInDist()` — which had it
+  right all along — decide the binary name, so there is one authority instead of two to drift.
+  Reported by snowfox with the diagnosis and the fix.
+
+## 1.12.7
 
 ### File preview: 3D models, video, audio and fonts
 

package/apps/desktop/machine-channel.js

@@ -0,0 +1,105 @@
+/** ⚠️  AUTO-GENERATED FROM src/machine-channel.ts — DO NOT EDIT. Run: bun run build */
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/machine-channel.ts
+var exports_machine_channel = {};
+__export(exports_machine_channel, {
+  MACHINE_CHANNEL_ENV: () => MACHINE_CHANNEL_ENV,
+  MACHINE_REQ_PREFIX: () => MACHINE_REQ_PREFIX,
+  MACHINE_RES_PREFIX: () => MACHINE_RES_PREFIX,
+  childEnvWithoutChannel: () => childEnvWithoutChannel,
+  formatRequest: () => formatRequest,
+  formatResponse: () => formatResponse,
+  machineChannelEnabled: () => machineChannelEnabled,
+  parseRequestLine: () => parseRequestLine,
+  parseResponseLine: () => parseResponseLine,
+  splitLines: () => splitLines
+});
+module.exports = __toCommonJS(exports_machine_channel);
+var MACHINE_REQ_PREFIX = "HJ_MACHINE_REQ ";
+var MACHINE_RES_PREFIX = "HJ_MACHINE_RES ";
+var MACHINE_CHANNEL_ENV = "HALTIJA_MACHINE_CHANNEL";
+function machineChannelEnabled(env) {
+  return env[MACHINE_CHANNEL_ENV] === "1";
+}
+function formatRequest(req) {
+  return MACHINE_REQ_PREFIX + JSON.stringify(req) + `
+`;
+}
+function formatResponse(res) {
+  return MACHINE_RES_PREFIX + JSON.stringify(res) + `
+`;
+}
+function parseRequestLine(line) {
+  if (!line.startsWith(MACHINE_REQ_PREFIX))
+    return null;
+  try {
+    const parsed = JSON.parse(line.slice(MACHINE_REQ_PREFIX.length));
+    if (typeof parsed?.id !== "string" || typeof parsed?.path !== "string")
+      return null;
+    if (!parsed.path.startsWith("/"))
+      return null;
+    return { method: "GET", ...parsed };
+  } catch {
+    return null;
+  }
+}
+function parseResponseLine(line) {
+  if (!line.startsWith(MACHINE_RES_PREFIX))
+    return null;
+  try {
+    const parsed = JSON.parse(line.slice(MACHINE_RES_PREFIX.length));
+    if (typeof parsed?.id !== "string" || typeof parsed?.status !== "number")
+      return null;
+    return { headers: {}, bodyB64: "", ...parsed };
+  } catch {
+    return null;
+  }
+}
+function splitLines(buffer) {
+  const parts = buffer.split(`
+`);
+  const rest = parts.pop() ?? "";
+  return { lines: parts, rest };
+}
+function childEnvWithoutChannel(env = process.env) {
+  const copy = { ...env };
+  delete copy[MACHINE_CHANNEL_ENV];
+  return copy;
+}

package/apps/desktop/machine-response.global.js

@@ -0,0 +1,74 @@
+/** ⚠️  AUTO-GENERATED FROM src/machine-response.ts — DO NOT EDIT. Run: bun run build */
+(() => {
+  var __defProp = Object.defineProperty;
+  var __getOwnPropNames = Object.getOwnPropertyNames;
+  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+  var __hasOwnProp = Object.prototype.hasOwnProperty;
+  function __accessProp(key) {
+    return this[key];
+  }
+  var __toCommonJS = (from) => {
+    var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+    if (entry)
+      return entry;
+    entry = __defProp({}, "__esModule", { value: true });
+    if (from && typeof from === "object" || typeof from === "function") {
+      for (var key of __getOwnPropNames(from))
+        if (!__hasOwnProp.call(entry, key))
+          __defProp(entry, key, {
+            get: __accessProp.bind(from, key),
+            enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+          });
+    }
+    __moduleCache.set(from, entry);
+    return entry;
+  };
+  var __moduleCache;
+  var __returnValue = (v) => v;
+  function __exportSetter(name, newValue) {
+    this[name] = __returnValue.bind(null, newValue);
+  }
+  var __export = (target, all) => {
+    for (var name in all)
+      __defProp(target, name, {
+        get: all[name],
+        enumerable: true,
+        configurable: true,
+        set: __exportSetter.bind(all, name)
+      });
+  };
+
+  // src/machine-response.ts
+  var exports_machine_response = {};
+  __export(exports_machine_response, {
+    machineResponseError: () => machineResponseError,
+    makeMachineResponse: () => makeMachineResponse
+  });
+  function makeMachineResponse(status, bodyB64, headers = {}) {
+    let decoded = null;
+    const decode = () => {
+      if (decoded === null) {
+        const bytes = Uint8Array.from(atob(bodyB64 || ""), (c) => c.charCodeAt(0));
+        decoded = new TextDecoder().decode(bytes);
+      }
+      return decoded;
+    };
+    return {
+      ok: status >= 200 && status < 300,
+      status,
+      headers,
+      b64: bodyB64 || "",
+      dataUrl: () => `data:${headers["content-type"] || "application/octet-stream"};base64,${bodyB64 || ""}`,
+      json: async () => JSON.parse(decode() || "{}"),
+      text: async () => decode()
+    };
+  }
+  function machineResponseError(status, message) {
+    return makeMachineResponse(status, btoa(JSON.stringify({ success: false, error: message })), {
+      "content-type": "application/json"
+    });
+  }
+  if (typeof globalThis !== "undefined" && typeof globalThis.document !== "undefined") {
+    globalThis.__hjMachineResponse = { makeMachineResponse, machineResponseError };
+  }
+})();

package/apps/desktop/main.js

@@ -25,6 +25,11 @@ const { spawn } = require('child_process')
 const http = require('http')
 const { attachNetwork, detachNetwork, getNetworkLog, getNetworkStats, clearNetwork, isMonitoring } = require('./cdp-network.js')
 const { buildServerEnv } = require('./server-env.js')
+// The wire protocol, generated from src/machine-channel.ts — NOT re-declared here. main.js used to
+// hand-roll the prefixes, the line split and the parse; that copy is where the __NEED_WINDOW__
+// regression came from, and it had no test while the src/ original did.
+const { MACHINE_REQ_PREFIX, MACHINE_RES_PREFIX, formatRequest, parseResponseLine, splitLines } =
+  require('./machine-channel.js')
 // ONE definition of where artifacts live and how long they live. Built from src/artifacts.ts.
 const { artifactDir, pruneKind } = require('./artifacts.js')
 
@@ -302,8 +307,14 @@ async function checkAndPromptMcpSetup() {
     }
   } else if (result.response === 2) {
     // Don't ask again - store preference
-    const store = require('electron-store')
     try {
+      // The require MUST be inside the try. It was outside, so a missing electron-store threw
+      // before the catch could run and the fallback below was unreachable — while its comment
+      // claimed otherwise. electron-store is declared in NO manifest (not the root's, not
+      // apps/desktop's), so for anyone installing from npm it is always missing and this path
+      // always threw. Found by a release-doctor check for shipped imports the manifest never
+      // declares. `hasSkippedMcpSetup()` below already had it right; the two disagreed.
+      const store = require('electron-store')
       const Store = store.default || store
       const appStore = new Store()
       appStore.set('skipMcpSetup', true)
@@ -1283,8 +1294,10 @@ function checkServerRunning() {
  * A Unix socket was the first choice and does not work — Bun 1.4.0 accepts the connection and
  * never answers (verified three ways against a working Node<->Node control). Don't retry it.
  */
-const MACHINE_REQ_PREFIX = 'HJ_MACHINE_REQ '
-const MACHINE_RES_PREFIX = 'HJ_MACHINE_RES '
+// Minted once per launch and handed to (a) the server via env and (b) the terminal iframe via its
+// URL. Never sent to a page, so a hostile srcdoc frame cannot obtain it (review M1).
+const WS_NONCE = require('crypto').randomBytes(24).toString('hex')
+
 const machinePending = new Map()
 let machineBuffer = ''
 let machineSeq = 0
@@ -1319,12 +1332,13 @@ function machineRequest(path, init = {}) {
           success: false, error: `Timed out waiting for ${path} on the machine channel.`,
         })).toString('base64') })
       }
-    }, 30000)
+    }, 45000) // > the server's own 30s command timeout, so a slow command returns its real
+    // (possibly truncated) output instead of this layer claiming the channel lost it.
     machinePending.set(id, (res) => { clearTimeout(timer); resolve(res) })
     const frame = { id, method: init.method || 'GET', path, headers: init.headers || {} }
     if (init.bodyB64 !== undefined) frame.bodyB64 = init.bodyB64
     try {
-      machineProc.stdin.write(MACHINE_REQ_PREFIX + JSON.stringify(frame) + '\n')
+      machineProc.stdin.write(formatRequest(frame))
     } catch (err) {
       if (machinePending.delete(id)) {
         clearTimeout(timer)
@@ -1336,6 +1350,8 @@ function machineRequest(path, init = {}) {
   })
 }
 
+ipcMain.handle('ws-nonce', () => WS_NONCE)
+
 ipcMain.handle('machine-request', async (_evt, path, init) => {
   // Only this prefix pair is reachable, so a compromised renderer cannot use the channel as a
   // general proxy to the server (e.g. to bypass a token on some unrelated endpoint).
@@ -1355,6 +1371,10 @@ const env = buildServerEnv(process.env, {
     role: role === 'public' ? 'public' : 'internal',
     isPrivate: IS_PRIVATE,
     portFile,
+    wsNonce: WS_NONCE,
+    // Without this the server has no nonce, so it refuses its OWN terminal frame — which is
+    // precisely what happened: the edit that added it matched the wrong indentation, str.replace
+    // silently did nothing, and the only symptom was a socket that would not open.
   })
   let proc
   if (serverPath && useCompiledBinary) {
@@ -1386,22 +1406,26 @@ const env = buildServerEnv(process.env, {
       // and buffered, or a large /files/tree answer arrives as fragments and never resolves.
       if (role === 'public') {
         machineBuffer += data.toString()
-        const parts = machineBuffer.split('\n')
-        machineBuffer = parts.pop()
-        for (const line of parts) {
-          if (!line.startsWith(MACHINE_RES_PREFIX)) {
-            if (line.trim()) console.log(`${label} ${line.trim()}`)
-            continue
-          }
-          try {
-            const res = JSON.parse(line.slice(MACHINE_RES_PREFIX.length))
+        const split = splitLines(machineBuffer)
+        machineBuffer = split.rest
+        for (const line of split.lines) {
+          // parseResponseLine returns null for anything that is not ours — log output, the banner,
+          // and the other prefixed messages are all expected here.
+          const res = parseResponseLine(line)
+          if (res) {
             const waiting = machinePending.get(res.id)
             if (waiting) { machinePending.delete(res.id); waiting(res) }
-          } catch {}
-        }
-        if (role === 'public' && machineBuffer.includes('__NEED_WINDOW__') && BrowserWindow.getAllWindows().length === 0) {
-          console.log('[Haltija Desktop] Server requested window, recreating...')
-          createWindow()
+            continue
+          }
+          if (line.trim()) console.log(`${label} ${line.trim()}`)
+          // Tested on the COMPLETE line, never on the residual buffer (review B2). The marker
+          // arrives newline-terminated, so it always lands in `lines` and the buffer is '' — the
+          // old check read `machineBuffer` and was therefore ALWAYS false, making window
+          // recreation dead code and hanging every `hj` command against a windowless app for 8s.
+          if (line.includes('__NEED_WINDOW__') && BrowserWindow.getAllWindows().length === 0) {
+            console.log('[Haltija Desktop] Server requested window, recreating...')
+            createWindow()
+          }
         }
         return
       }

package/apps/desktop/preload.js

@@ -34,6 +34,8 @@ contextBridge.exposeInMainWorld('haltija', {
   // Machine control over the server's stdio (#40). /terminal/* and /files/* are refused on the
   // network listener; this is how the app's own tabs still reach them. Returns {status, bodyB64}.
   machineRequest: (path, init) => ipcRenderer.invoke('machine-request', path, init),
+  // Per-launch secret the terminal frame presents on /ws/terminal (review M1).
+  wsNonce: () => ipcRenderer.invoke('ws-nonce'),
 
   // Screen capture
   capturePage: () => ipcRenderer.invoke('capture-page'),

package/apps/desktop/renderer/machine-relay.js

@@ -1,3 +1,4 @@
+import { makeMachineResponse } from './machine-response.js'
 /**
  * Relay for the terminal iframe's machine-control calls (#40).
  *
@@ -11,6 +12,27 @@
  * so this is an extra message type on a channel that exists, not a new mechanism.
  */
 
+
+/**
+ * Is this the content window of a terminal iframe we created?
+ *
+ * Identity by object, not by origin string: `terminal.html` is loaded from disk, so its origin is
+ * `null`/`file://` — indistinguishable from any other local frame, and trivially claimed. The tab
+ * registry holds the actual elements, so comparing `contentWindow` identity is both stronger and
+ * simpler than any string check.
+ */
+function isKnownTerminalFrame(source) {
+  if (!source) return false
+  // Straight from the DOM rather than through the tab registry: the class is set where the iframe
+  // is created (tabs.js), the registry stores it under `webview` (not `iframe`), and reaching
+  // across modules for a shape that can be renamed is how this check would silently start
+  // returning false — which fails CLOSED here, but would break every terminal tab.
+  for (const frame of document.querySelectorAll('iframe.terminal-frame')) {
+    if (frame.contentWindow && frame.contentWindow === source) return true
+  }
+  return false
+}
+
 const RELAY_REQUEST = 'hj-machine-request'
 const RELAY_RESPONSE = 'hj-machine-response'
 
@@ -19,6 +41,22 @@ export function initMachineRelay() {
     const msg = event.data
     if (!msg || msg.type !== RELAY_REQUEST || typeof msg.id !== 'string') return
 
+    // DEFAULT-DENY on the sender, not just the message shape (review B1).
+    //
+    // This validated the shape only, then forwarded to shell + filesystem. Today the sole legitimate
+    // sender is a terminal iframe — content tabs are <webview> guests and cannot postMessage the
+    // embedder — so it was latent. But it is exactly what turns "third-party code in a preview
+    // pane" into "third-party code with a shell", and any plain <iframe> added to the renderer
+    // later (a docs pane, a preview, an OAuth page) would inherit shell access by accident rather
+    // than by decision.
+    //
+    // Same discipline as isRefusedMachineControlPath: the sender must be recognised, not merely
+    // fail to look wrong.
+    if (!isKnownTerminalFrame(event.source)) {
+      console.warn('[Haltija] machine-request from an unrecognised frame — refused')
+      return
+    }
+
     // Answer through the SOURCE window, not a broadcast: several terminal tabs can be open, and
     // posting to all of them would let one tab observe another's file contents and command output.
     const reply = (payload) => {
@@ -68,24 +106,7 @@ export function initMachineRelay() {
  * conversion is mechanical and a missed site is visible rather than subtle.
  */
 export async function machineFetch(path, init = {}) {
-  const respond = (status, bodyB64, headers = {}) => {
-    let text = null
-    const decode = () => {
-      if (text === null) {
-        const bytes = Uint8Array.from(atob(bodyB64 || ''), (c) => c.charCodeAt(0))
-        text = new TextDecoder().decode(bytes)
-      }
-      return text
-    }
-    return {
-      ok: status >= 200 && status < 300,
-      status,
-      headers,
-      b64: bodyB64 || '',
-      json: async () => JSON.parse(decode() || '{}'),
-      text: async () => decode(),
-    }
-  }
+  const respond = makeMachineResponse // shared with terminal.html via src/machine-response.ts
 
   if (!window.haltija?.machineRequest) {
     return respond(503, btoa(JSON.stringify({

package/apps/desktop/renderer/machine-response.js

@@ -0,0 +1,33 @@
+/** ⚠️  AUTO-GENERATED FROM src/machine-response.ts — DO NOT EDIT. Run: bun run build */
+// src/machine-response.ts
+function makeMachineResponse(status, bodyB64, headers = {}) {
+  let decoded = null;
+  const decode = () => {
+    if (decoded === null) {
+      const bytes = Uint8Array.from(atob(bodyB64 || ""), (c) => c.charCodeAt(0));
+      decoded = new TextDecoder().decode(bytes);
+    }
+    return decoded;
+  };
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers,
+    b64: bodyB64 || "",
+    dataUrl: () => `data:${headers["content-type"] || "application/octet-stream"};base64,${bodyB64 || ""}`,
+    json: async () => JSON.parse(decode() || "{}"),
+    text: async () => decode()
+  };
+}
+function machineResponseError(status, message) {
+  return makeMachineResponse(status, btoa(JSON.stringify({ success: false, error: message })), {
+    "content-type": "application/json"
+  });
+}
+if (typeof globalThis !== "undefined" && typeof globalThis.document !== "undefined") {
+  globalThis.__hjMachineResponse = { makeMachineResponse, machineResponseError };
+}
+export {
+  machineResponseError,
+  makeMachineResponse
+};

package/apps/desktop/renderer/tabs.js

@@ -240,7 +240,15 @@ export async function createTerminalTab(mode = 'human') {
   // else talked to our own ephemeral server, which is an isolation violation the private mode
   // exists to prevent. It only became visible when /terminal/* moved to the stdio pipe (#40) and
   // the two transports could no longer agree by accident.
-  iframe.src = `terminal.html?port=${resolvePublicPort()}&mode=${mode}${cwdParam}`
+  // The nonce proves this frame belongs to the app when it opens /ws/terminal — a hostile page's
+  // sandboxed srcdoc frame sends the same `Origin: null` but cannot obtain this (review M1).
+  // Resolved before the frame loads; without it the socket is refused and the terminal is inert,
+  // so a failure here is loud rather than subtle.
+  Promise.resolve(window.haltija?.wsNonce?.() ?? '').then((nonce) => {
+    iframe.src =
+      `terminal.html?port=${resolvePublicPort()}&mode=${mode}${cwdParam}` +
+      (nonce ? `&nonce=${encodeURIComponent(nonce)}` : '')
+  })
   iframe.className = 'terminal-frame'
 
   el.webviewContainer.appendChild(iframe)

package/apps/desktop/resources/component.js

@@ -46,7 +46,7 @@
   });
 
   // src/version.ts
-  var VERSION = "1.12.7";
+  var VERSION = "1.12.9";
 
   // src/ws-url.ts
   function httpBaseFromWsUrl(wsUrl2, fallback = "http://localhost:8700") {

package/apps/desktop/server-env.js

@@ -58,6 +58,10 @@ function buildServerEnv(base, opts) {
     env.HALTIJA_MACHINE_CHANNEL = "1";
   else
     delete env.HALTIJA_MACHINE_CHANNEL;
+  if (opts.wsNonce)
+    env.HALTIJA_WS_NONCE = opts.wsNonce;
+  else
+    delete env.HALTIJA_WS_NONCE;
   if (opts.isPrivate) {
     env.HALTIJA_PRIVATE = "1";
     env.HALTIJA_NO_RETIRE = "1";