kritya 0.8.21-beta → 0.8.22-beta

package/dist/atomicWrite.js

@@ -59,8 +59,16 @@ export async function writeFileAtomic(filePath, data, options = {}) {
     const target = resolveTarget(filePath);
     const mode = options.mode ?? existingMode(target);
     const tmp = tempPathFor(target);
+    const encoding = options.encoding ?? (typeof data === "string" ? "utf8" : null);
     try {
-        await fsp.writeFile(tmp, data, options.encoding ?? (typeof data === "string" ? "utf8" : null));
+        // Pass `mode` to the create itself rather than chmod-ing afterward: a
+        // separate chmod call leaves a window where the temp file sits at
+        // Node's default (umask-derived, typically world/group-readable) mode
+        // before being narrowed — for a sensitive target (e.g. config.json) that
+        // briefly exposes contents a caller explicitly asked to keep owner-only.
+        // The chmod is kept too, since umask can still trim bits `mode` set on
+        // some platforms.
+        await fsp.writeFile(tmp, data, { encoding, ...(mode !== undefined ? { mode } : {}) });
         if (mode !== undefined)
             await fsp.chmod(tmp, mode);
         await fsp.rename(tmp, target);
@@ -69,7 +77,9 @@ export async function writeFileAtomic(filePath, data, options = {}) {
         await fsp.rm(tmp, { force: true }).catch(() => { });
         if (!isRenameFallback(err))
             throw err;
-        await fsp.writeFile(filePath, data, options.encoding ?? (typeof data === "string" ? "utf8" : null));
+        await fsp.writeFile(filePath, data, { encoding, ...(mode !== undefined ? { mode } : {}) });
+        if (mode !== undefined)
+            await fsp.chmod(filePath, mode);
     }
 }
 export function writeFileAtomicSync(filePath, data, options = {}) {
@@ -101,6 +111,10 @@ export function writeFileAtomicSync(filePath, data, options = {}) {
             ...(options.encoding ? { encoding: options.encoding } : {}),
             ...(mode !== undefined ? { mode } : {}),
         });
+        // Same umask concern as the primary path above: `mode` on writeFileSync
+        // can still be trimmed by umask, so enforce it explicitly.
+        if (mode !== undefined)
+            fs.chmodSync(filePath, mode);
     }
 }
 function isRenameFallback(err) {

package/dist/config/config.js

@@ -3,8 +3,9 @@ import os from "node:os";
 import path from "node:path";
 import { hardenWindowsDir } from "./winAcl.js";
 import { debugLog } from "./debug.js";
+import { writeFileAtomicSync } from "../atomicWrite.js";
 export const CONFIG_DIR = path.join(os.homedir(), ".kritya");
-const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+export const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
 export const NVIDIA_BASE_URL = "https://integrate.api.nvidia.com/v1";
 /**
  * Built-in OpenAI-compatible providers. Users select one with `provider` in
@@ -136,15 +137,13 @@ export function saveConfig(patch) {
     // config.json can hold a literal apiKey — keep it readable only by the owner.
     fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
     hardenWindowsDir(CONFIG_DIR);
-    fs.writeFileSync(CONFIG_FILE, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
-    // `mode` on writeFileSync only applies when creating a new file; enforce it
-    // even if config.json pre-existed with looser permissions.
-    try {
-        fs.chmodSync(CONFIG_FILE, 0o600);
-    }
-    catch (err) {
-        debugLog(`saveConfig chmod(${CONFIG_FILE})`, err);
-    }
+    // Atomic (write-to-temp-then-rename) rather than a direct write: config.json
+    // holds API keys, and a crash mid-write would otherwise leave it truncated
+    // and unreadable on next launch. `mode: 0o600` is forced on every save
+    // (rather than only applying on creation, like a plain writeFileSync would),
+    // so a config.json that pre-existed with looser permissions still ends up
+    // owner-only.
+    writeFileAtomicSync(CONFIG_FILE, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
 }
 /**
  * A copy of process.env with kritya-managed secrets removed. Every built-in

package/dist/mcp/client.js

@@ -6,7 +6,7 @@ import { NOOP_TRACER } from "../telemetry/tracer.js";
 import { McpAuthRequiredError } from "./oauth.js";
 import { missingVars } from "./servers.js";
 import { HttpTransport, StdioTransport } from "./transport.js";
-import { isPrivateOrLoopbackHost } from "../net/urlSafety.js";
+import { assertSafeUrl as assertSafeUrlShared } from "../net/urlSafety.js";
 import { checkToolsShape, serverFingerprint } from "../trust/mcpTrust.js";
 import { probeStdioEra, probeHttpEra } from "./eraDetect.js";
 import { ModernMcpConnection } from "./clientModern.js";
@@ -545,42 +545,17 @@ export function toolAllowed(name, filter) {
         return true;
     return filter.allow.some((p) => matchesPattern(name, p));
 }
-/** Loopback is exempt from the https requirement: there's no network to sniff. */
-function isLoopback(hostname) {
-    const h = hostname.replace(/^\[|\]$/g, "");
-    return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost");
-}
 /**
- * Reject a remote server reachable only over plaintext. `/mcp add` already
- * refuses these, but that guards one entrance: a server hand-written into
- * ~/.kritya/config.json or a repo's .mcp.json never passes through it and
- * would happily POST a bearer token in the clear. This is the choke point all
- * three sources share.
+ * Reject a remote server reachable only over plaintext, or pointed at a
+ * private/internal address. `/mcp add` already refuses these, but that
+ * guards one entrance: a server hand-written into ~/.kritya/config.json or a
+ * repo's .mcp.json never passes through it and would happily POST a bearer
+ * token in the clear. This is the choke point all three sources share —
+ * delegates to the same check used for OAuth discovery/token endpoints
+ * (src/mcp/oauth.ts) so the two can't silently drift apart.
  */
 export function assertSafeUrl(name, url) {
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch {
-        throw new Error(`server "${name}" has an invalid url: ${url}`);
-    }
-    // https alone doesn't mean the traffic (incl. any bearer token in headers)
-    // stays where the user intends — a config pointing at 169.254.169.254 or
-    // another private/internal address would still ship credentials there.
-    // Loopback is exempt: that's this app talking to itself, nothing to leak to.
-    if (!isLoopback(parsed.hostname) && isPrivateOrLoopbackHost(parsed.hostname)) {
-        throw new Error(`server "${name}" points at a private/internal address (${parsed.hostname}) — refusing to connect.`);
-    }
-    if (parsed.protocol === "https:")
-        return parsed;
-    if (parsed.protocol === "http:" && isLoopback(parsed.hostname))
-        return parsed;
-    if (parsed.protocol !== "http:") {
-        throw new Error(`server "${name}" uses unsupported scheme "${parsed.protocol}" — use https://`);
-    }
-    throw new Error(`server "${name}" uses plain http:// (${parsed.host}) — an MCP session carries ` +
-        `your credentials in cleartext over it. Use https:// (localhost is exempt).`);
+    return assertSafeUrlShared(`server "${name}"`, url);
 }
 function makeTransport(name, cfg, workspace) {
     if (cfg.url) {

package/dist/mcp/oauth.js

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import { VERSION } from "../version.js";
 import { debugLog } from "../config/debug.js";
 import { isExpired, loadAuth, saveAuth } from "./tokens.js";
+import { assertSafeUrl } from "../net/urlSafety.js";
 /**
  * OAuth 2.1 for remote (Streamable HTTP) MCP servers.
  *
@@ -43,8 +44,18 @@ export class McpAuthRequiredError extends Error {
 function ua() {
     return { "user-agent": `kritya/${VERSION}`, accept: "application/json" };
 }
+/**
+ * Fetches JSON from a URL that isn't necessarily one kritya's own config
+ * chose — the .well-known candidates are built from a `serverUrl`/`issuer`,
+ * but a caller can also pass a `resource_metadata` URL taken straight off a
+ * server's WWW-Authenticate header, or an `authorization_servers` entry
+ * from that server's own metadata document. Both are attacker-controlled if
+ * the MCP server is malicious or compromised, so validate here rather than
+ * trust every candidate this module constructs.
+ */
 async function getJson(url, timeoutMs = DISCOVERY_TIMEOUT_MS) {
-    const res = await fetch(url, { headers: ua(), signal: AbortSignal.timeout(timeoutMs) });
+    const safe = assertSafeUrl("OAuth discovery endpoint", url);
+    const res = await fetch(safe, { headers: ua(), signal: AbortSignal.timeout(timeoutMs) });
     if (!res.ok)
         throw new Error(`HTTP ${res.status} from ${url}`);
     return res.json();
@@ -156,7 +167,7 @@ export async function registerClient(meta, redirectUri, scope) {
         throw new Error(`authorization server ${meta.issuer} does not support dynamic client registration; ` +
             `register kritya manually and put the client_id in mcp-auth.json`);
     }
-    const res = await fetch(meta.registrationEndpoint, {
+    const res = await fetch(assertSafeUrl("OAuth registration endpoint", meta.registrationEndpoint), {
         method: "POST",
         headers: { ...ua(), "content-type": "application/json" },
         body: JSON.stringify({
@@ -204,7 +215,7 @@ async function postToken(tokenEndpoint, params, clientSecret) {
         const basic = Buffer.from(`${params.client_id}:${clientSecret}`).toString("base64");
         headers.authorization = `Basic ${basic}`;
     }
-    const res = await fetch(tokenEndpoint, {
+    const res = await fetch(assertSafeUrl("OAuth token endpoint", tokenEndpoint), {
         method: "POST",
         headers,
         body: new URLSearchParams(params).toString(),
@@ -270,7 +281,7 @@ export async function revokeToken(auth) {
     const token = auth.refreshToken ?? auth.accessToken;
     const hint = auth.refreshToken ? "refresh_token" : "access_token";
     try {
-        const res = await fetch(auth.revocationEndpoint, {
+        const res = await fetch(assertSafeUrl("OAuth revocation endpoint", auth.revocationEndpoint), {
             method: "POST",
             headers: { ...ua(), "content-type": "application/x-www-form-urlencoded" },
             body: new URLSearchParams({

package/dist/net/urlSafety.js

@@ -156,3 +156,36 @@ export function isLoopbackHost(rawHost) {
         return isLoopbackIPv6Groups(v6);
     return false;
 }
+/**
+ * Reject a URL reachable only over plaintext, or pointed at a private/
+ * internal address — the shared choke point for every URL kritya's own
+ * process fetches on the user's behalf with credentials attached (MCP
+ * server URLs, OAuth discovery/token/revocation endpoints, …). `label`
+ * identifies the source in the thrown error (a server name, "OAuth token
+ * endpoint", etc). Loopback is exempt from the https requirement: that's
+ * this app talking to itself, nothing on the wire to sniff.
+ */
+export function assertSafeUrl(label, url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`${label} has an invalid url: ${url}`);
+    }
+    // https alone doesn't mean the traffic (incl. any bearer token) stays
+    // where the caller intends — a URL pointing at 169.254.169.254 or another
+    // private/internal address would still ship credentials there.
+    if (!isLoopbackHost(parsed.hostname) && isPrivateOrLoopbackHost(parsed.hostname)) {
+        throw new Error(`${label} points at a private/internal address (${parsed.hostname}) — refusing to connect.`);
+    }
+    if (parsed.protocol === "https:")
+        return parsed;
+    if (parsed.protocol === "http:" && isLoopbackHost(parsed.hostname))
+        return parsed;
+    if (parsed.protocol !== "http:") {
+        throw new Error(`${label} uses unsupported scheme "${parsed.protocol}" — use https://`);
+    }
+    throw new Error(`${label} uses plain http:// (${parsed.host}), which would carry credentials in cleartext. ` +
+        `Use https:// (localhost is exempt).`);
+}

package/dist/provider/client.js

@@ -1,5 +1,6 @@
 import OpenAI from "openai";
 import { NVIDIA_BASE_URL } from "../config/config.js";
+import { assertSafeUrl } from "../net/urlSafety.js";
 import { NOOP_TRACER } from "../telemetry/tracer.js";
 import { recoverToolCalls } from "./textToolCalls.js";
 /** Retry transient provider failures (429 / 5xx / network) with backoff. */
@@ -192,6 +193,10 @@ export class ProviderClient {
     maxTokens;
     streamIdleTimeoutMs;
     constructor(apiKey, baseURL = NVIDIA_BASE_URL, sampling = {}, timeouts = {}) {
+        // Provider URLs can carry an API key, so apply the same scheme and
+        // private-network protections used by MCP HTTP endpoints before handing
+        // the URL to the SDK.
+        assertSafeUrl("provider base URL", baseURL);
         // We do our own streaming-aware retry loop, so disable the SDK's.
         this.client = new OpenAI({
             apiKey,

package/dist/session/store.js

@@ -159,15 +159,47 @@ export class SessionStore {
      * accept a session path from outside the process (e.g. the Electron
      * renderer over IPC) must check this before loading it: without it,
      * "load this session" is really "read any file the OS user can read".
+     *
+     * The lexical check (path.relative on the unresolved names) only rules out
+     * `..` segments in the string itself — it doesn't notice a symlink planted
+     * inside the session directory that points somewhere else entirely. Such a
+     * symlink would have a path that lexically resolves inside the session dir
+     * while the filesystem happily follows it out. Canonicalizing with
+     * fs.realpathSync and re-checking containment against that catches it: a
+     * symlink escaping the directory resolves to a real path outside it and
+     * gets rejected, exactly like an out-of-tree file would.
      */
     static isSessionFile(workspace, filePath) {
         const dir = sessionDir(workspace);
         const resolved = path.resolve(dir, filePath);
         const relative = path.relative(dir, resolved);
-        return (resolved.endsWith(".jsonl") &&
-            relative !== "" &&
-            !relative.startsWith("..") &&
-            !path.isAbsolute(relative));
+        if (!resolved.endsWith(".jsonl") ||
+            relative === "" ||
+            relative.startsWith("..") ||
+            path.isAbsolute(relative)) {
+            return false;
+        }
+        let realDir;
+        let realFile;
+        try {
+            realDir = fs.realpathSync(dir);
+            realFile = fs.realpathSync(resolved);
+        }
+        catch {
+            // Doesn't exist, or a component along the way isn't accessible —
+            // either way there's nothing real to load.
+            return false;
+        }
+        const realRelative = path.relative(realDir, realFile);
+        if (realRelative === "" || realRelative.startsWith("..") || path.isAbsolute(realRelative)) {
+            return false;
+        }
+        try {
+            return fs.statSync(realFile).isFile();
+        }
+        catch {
+            return false;
+        }
     }
     static loadFile(filePath) {
         const messages = [];

package/dist/shell/background.js

@@ -2,7 +2,10 @@ import { spawn } from "node:child_process";
 import os from "node:os";
 import { scrubbedShellEnv } from "../config/config.js";
 import { buildSandboxedCommand, requiresSandbox, sandboxUnavailableReason, shouldSandbox, } from "./sandbox.js";
+import { redactSecrets } from "../tools/secretScan.js";
 const MAX_BUFFER_CHARS = 50_000;
+const MAX_COMPLETED_PROCESSES = 100;
+const COMPLETED_PROCESS_RETENTION_MS = 5 * 60_000;
 /**
  * Registry of long-running processes the agent started with shell
  * background:true (dev servers, watchers). Captures a rolling tail of
@@ -54,9 +57,19 @@ class BackgroundManager {
             // approach) mis-parses commands that themselves contain quotes.
             proc = spawn(command, { ...spawnOpts, shell: true });
         }
-        const entry = { proc, command, buffer: "", exitCode: null, running: true };
+        // Keep secrets out of the long-lived registry. The child still receives
+        // the original command, but the retained command is redacted.
+        const entry = {
+            proc,
+            command: redactSecrets(command).redacted,
+            buffer: "",
+            exitCode: null,
+            running: true,
+        };
         const append = (chunk) => {
-            entry.buffer += chunk.toString();
+            // Re-scan the rolling buffer so a secret split across stream chunks is
+            // redacted before it is retained.
+            entry.buffer = redactSecrets(entry.buffer + chunk.toString()).redacted;
             if (entry.buffer.length > MAX_BUFFER_CHARS) {
                 entry.buffer = entry.buffer.slice(-MAX_BUFFER_CHARS);
             }
@@ -68,21 +81,43 @@ class BackgroundManager {
         proc.on("exit", (code) => {
             entry.running = false;
             entry.exitCode = code;
+            entry.finishedAt = Date.now();
             proc.stdout?.destroy();
             proc.stderr?.destroy();
             cleanup?.();
+            this.scheduleCleanup(id, entry);
         });
         proc.on("error", (err) => {
             entry.running = false;
-            entry.buffer += `\n[failed to start: ${err.message}]`;
+            entry.finishedAt = Date.now();
+            entry.buffer = redactSecrets(`${entry.buffer}\n[failed to start: ${err.message}]`).redacted;
             // If the sandbox binary itself fails to spawn, "exit" may never fire, so
             // the macOS temp profile would leak. cleanup is fs.rm({force:true}),
             // which is idempotent, so running it from both handlers is safe.
             cleanup?.();
+            this.scheduleCleanup(id, entry);
         });
         this.procs.set(id, entry);
+        this.pruneCompleted();
         return { id };
     }
+    scheduleCleanup(id, entry) {
+        const timer = setTimeout(() => {
+            if (this.procs.get(id) === entry && !entry.running)
+                this.procs.delete(id);
+        }, COMPLETED_PROCESS_RETENTION_MS);
+        timer.unref();
+        this.pruneCompleted();
+    }
+    pruneCompleted() {
+        const completed = [...this.procs.entries()]
+            .filter(([, entry]) => !entry.running)
+            .sort(([, a], [, b]) => (a.finishedAt ?? 0) - (b.finishedAt ?? 0));
+        while (completed.length > MAX_COMPLETED_PROCESSES) {
+            const [id] = completed.shift();
+            this.procs.delete(id);
+        }
+    }
     signal(entry, sig) {
         try {
             if (os.platform() !== "win32" && entry.proc.pid) {

package/dist/tools/fetchUrl.js

@@ -1,4 +1,5 @@
 import { lookup as dnsLookup } from "node:dns/promises";
+import { Agent } from "undici";
 import { truncateResult } from "./common.js";
 import { isPrivateOrLoopbackHost } from "../net/urlSafety.js";
 /** Cap on how much text a single fetch returns, unless the caller asks for less. */
@@ -46,10 +47,13 @@ function assertPublicUrl(raw) {
 /**
  * Resolve `hostname` and check whether any answer is private/loopback.
  * assertPublicUrl only checks the literal hostname string, so a
- * public-looking name that resolves (now, or on a later request) to an
- * internal IP — DNS rebinding, or simply attacker-controlled DNS — slips
- * past it. This closes that gap for the initial request; lookupFn is
- * injectable for tests, and defaults to a real DNS resolution.
+ * public-looking name that resolves to an internal IP — DNS rebinding, or
+ * simply attacker-controlled DNS — slips past it. This is only a fast,
+ * friendly pre-check (a clear "refusing to fetch" error instead of a raw
+ * connection failure); the actual boundary is the pinned lookup on
+ * `pinnedDispatcher` below, which validates the one DNS answer that's
+ * actually connected to rather than resolving twice. lookupFn is injectable
+ * for tests, and defaults to a real DNS resolution.
  */
 export async function hostResolvesToPrivateAddress(hostname, lookupFn = dnsLookup) {
     try {
@@ -63,22 +67,61 @@ export async function hostResolvesToPrivateAddress(hostname, lookupFn = dnsLooku
 }
 /** Refuse to keep chasing redirects forever. */
 const MAX_REDIRECTS = 5;
+/**
+ * The actual SSRF boundary: a connect-time `lookup` on a dedicated undici
+ * Agent, so the address that gets validated is the exact address the socket
+ * connects to — one DNS answer, not two. Checking the hostname up front and
+ * then letting `fetch` re-resolve it independently (the previous approach)
+ * left a TOCTOU window: attacker-controlled or short-TTL DNS can answer
+ * differently the second time (classic DNS rebinding). Pinning the lookup
+ * closes that regardless of hop, hostname, or TTL.
+ */
+const pinnedDispatcher = new Agent({
+    connect: {
+        lookup(hostname, options, callback) {
+            dnsLookup(hostname, { all: true })
+                .then((addresses) => {
+                if (addresses.length === 0) {
+                    callback(new Error(`Could not resolve ${hostname}`), []);
+                    return;
+                }
+                const bad = addresses.find((a) => isPrivateOrLoopbackHost(a.address));
+                if (bad) {
+                    callback(new Error(`Refusing to connect to ${hostname}: resolves to private/internal address ${bad.address}`), []);
+                    return;
+                }
+                if (options.all) {
+                    callback(null, addresses);
+                }
+                else {
+                    const chosen = addresses[0];
+                    callback(null, chosen.address, chosen.family);
+                }
+            })
+                .catch((err) => callback(err, []));
+        },
+    },
+});
 /**
  * Fetch `url`, following redirects manually so every hop — not just the
- * original URL — is checked against assertPublicUrl. A public URL that
- * 302s to 169.254.169.254 or localhost would otherwise sail straight past
- * the initial check, since `redirect: "follow"` never re-validates.
+ * original URL — is checked against assertPublicUrl before the (DNS-pinned)
+ * connection is even attempted. A public URL that 302s to 169.254.169.254
+ * or localhost would otherwise sail straight past the initial check, since
+ * `redirect: "follow"` never re-validates.
  */
-async function assertNotDnsRebound(url) {
-    if (await hostResolvesToPrivateAddress(url.hostname)) {
-        throw new Error(`Refusing to fetch ${url.hostname}: resolves to a private/internal address`);
-    }
-}
 async function fetchFollowingRedirects(url, signal, headers) {
     let current = url;
-    await assertNotDnsRebound(current);
     for (let hop = 0;; hop++) {
-        const res = await fetch(current, { redirect: "manual", signal, headers });
+        if (await hostResolvesToPrivateAddress(current.hostname)) {
+            throw new Error(`Refusing to fetch ${current.hostname}: resolves to a private/internal address`);
+        }
+        const init = {
+            redirect: "manual",
+            signal,
+            headers,
+            dispatcher: pinnedDispatcher,
+        };
+        const res = await fetch(current, init);
         const isRedirect = res.status >= 300 && res.status < 400;
         const location = res.headers.get("location");
         if (!isRedirect || !location) {
@@ -88,7 +131,6 @@ async function fetchFollowingRedirects(url, signal, headers) {
             throw new Error(`Too many redirects fetching ${url.href} (stopped at ${current.href})`);
         }
         current = assertPublicUrl(new URL(location, current).href);
-        await assertNotDnsRebound(current);
     }
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.21-beta",
+  "version": "0.8.22-beta",
   "description": "Kritya — a lean, provider-agnostic terminal coding agent (NVIDIA, OpenAI, OpenRouter, Groq, Ollama, and more)",
   "type": "module",
   "publishConfig": {
@@ -67,7 +67,8 @@
     "pdfjs-dist": "^6.3.289",
     "pptxgenjs": "^4.0.1",
     "react": "^19.2.8",
-    "string-width": "^8.2.2"
+    "string-width": "^8.2.2",
+    "undici": "^7.29.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",