levix-bot 2.1.0 → 2.1.2

package/app.cjs

@@ -41,11 +41,11 @@ function isAllowedOrigin(origin, host) {
 }
 
 // Browsers may legitimately serialize the Origin header as the literal string
-// "null" for a same-origin navigation in an opaque-origin context. Treating
-// that as a foreign origin breaks first-run/login forms in real browsers even
-// though Sec-Fetch-Site still proves the navigation is same-origin. Fetch
-// metadata headers are forbidden to page JavaScript, so they are a stronger
-// browser signal than trying to special-case the string "null" globally.
+// "null" for a same-origin navigation in an opaque-origin context. Prefer
+// Fetch Metadata when the browser sends it. Some Chromium form navigations omit
+// Sec-Fetch-Site entirely, so only the two credential-gated auth forms get a
+// narrow fallback for Origin:null; every other mutation remains strict.
+const OPAQUE_ORIGIN_AUTH_PATHS = new Set(["/setup", "/login"]);
 function isAllowedMutationRequest(req) {
   const origin = req.get("origin");
   const host = req.get("host");
@@ -58,6 +58,14 @@ function isAllowedMutationRequest(req) {
   if (fetchSite === "same-origin") return true;
   if (fetchSite === "cross-site") return false;
 
+  // Real Chromium can submit a top-level auth form with Origin:null and no
+  // Sec-Fetch-Site header. Setup is still protected by the one-time setup code
+  // for remote clients; login by the password; both share TCP-peer throttling.
+  // Do not generalize this exception to dashboard APIs or logout.
+  if (origin === "null" && !fetchSite && OPAQUE_ORIGIN_AUTH_PATHS.has(req.path)) {
+    return true;
+  }
+
   return isAllowedOrigin(origin, host);
 }
 

package/deploy/install.sh

@@ -66,21 +66,30 @@ node_major() {
   esac
 }
 
+# Read distro metadata in a subshell. /etc/os-release commonly defines VERSION,
+# which must never overwrite Levix's own release VERSION in the parent shell.
+read_os_id() (
+  local os_release="$1"
+  [ -r "$os_release" ] || return 1
+  # shellcheck disable=SC1090
+  . "$os_release"
+  printf '%s\n' "${ID:-}"
+)
+
 install_node24() {
-  [ -r /etc/os-release ] ||
+  local distro_id
+  distro_id="$(read_os_id /etc/os-release)" ||
     die "Node ${MIN_NODE_MAJOR}+ is required. Automatic Node installation is supported on Debian and Ubuntu only."
 
-  # shellcheck disable=SC1091
-  . /etc/os-release
-  case "${ID:-}" in
+  case "$distro_id" in
     debian|ubuntu) ;;
     *)
-      die "Node ${MIN_NODE_MAJOR}+ is required. Automatic Node installation is supported on Debian and Ubuntu only (found ${ID:-unknown}). Install Node ${MIN_NODE_MAJOR}+ and run this installer again."
+      die "Node ${MIN_NODE_MAJOR}+ is required. Automatic Node installation is supported on Debian and Ubuntu only (found ${distro_id:-unknown}). Install Node ${MIN_NODE_MAJOR}+ and run this installer again."
       ;;
   esac
 
   command -v apt-get >/dev/null 2>&1 ||
-    die "This looks like ${ID}, but apt-get is unavailable. Install Node ${MIN_NODE_MAJOR}+ and run this installer again."
+    die "This looks like ${distro_id}, but apt-get is unavailable. Install Node ${MIN_NODE_MAJOR}+ and run this installer again."
 
   say "Installing Node ${MIN_NODE_MAJOR} from NodeSource…"
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "levix-bot",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "A self-hosted personal WhatsApp bot with an AI agent, group moderation and a web control panel.",
   "main": "src/index.js",
   "scripts": {