loom-agent 1.2.33 → 1.2.36

package/CHANGELOG.md

@@ -4,6 +4,71 @@ All notable changes to **Loom Code** are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.36] — fix `loom web` / `loom acp` / `loom attach`
+
+### Fixed
+- **`loom web` launched the TUI instead of the browser server.** Since 1.2.34
+  the npm shims prefer `bin/loom-bun.js`, whose non-TUI branch routed every
+  subcommand into `src/core/cli.js`'s interactive `main()` — which has no
+  handler for `web`/`acp`/`attach`, so control fell through to the full-screen
+  app (reproduced: splash painted, no HTTP listener). `bin/loom-bun.js` now
+  routes those three subcommands directly to their own entry points, exactly
+  like `bin/loom.js` always did. Verified end-to-end on a global install:
+  `/api/health` → 200, UI served, banner prints.
+
+## [1.2.35] — security hardening
+
+### Fixed
+- **webfetch SSRF guard (`src/tools/index.js`).** The fetch tool is driven by
+  the model, and prompt-injected page content could steer it at cloud
+  metadata (`169.254.169.254`), localhost services, or internal hosts.
+  webfetch now allows only `http:`/`https:` (no `file:`/`ftp:`/`data:`),
+  refuses loopback, RFC1918, CGNAT, link-local/metadata, IPv6 ULA/link-local
+  and IPv4-mapped targets, **resolves DNS before connecting** so
+  hostname→internal-IP tricks fail, follows redirects manually and re-checks
+  every hop, and fails closed on unresolvable hosts.
+- **MCP servers no longer inherit the full shell environment**
+  (`src/mcp/mcp-client.js`). Every spawned MCP server used to receive all of
+  `process.env` — provider API keys, cloud tokens, cookies — handing them to
+  whatever npm package a config starts. Servers now get a minimal OS/runtime
+  baseline (PATH, ComSpec, TEMP/HOME, proxy vars) plus only what their own
+  config explicitly declares (`cfg.env`). Secrets are opt-in per server.
+- **Skills install name traversal blocked (`src/skills/skills-manager.js`).**
+  A remote-provided install name like `../../escapee` was joined raw onto
+  `~/.loom/skills`. Names are now a strict allowlist
+  (`^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$`); traversal attempts error instead of
+  silently renaming or escaping the skills directory.
+
+### Added
+- **`loom web` session hardening (`src/web/web-server.js`).** Login tokens
+  previously lived until server restart; they now expire after **12 h**
+  (tunable via `LOOM_SERVER_TOKEN_TTL_MS`, cookie `Max-Age` kept in sync), a
+  lazy sweep drops expired tokens, and new **`POST /api/auth/logout`**
+  revokes the presented token immediately.
+- **Security headers on every response:** `X-Content-Type-Options: nosniff`,
+  `X-Frame-Options: DENY`, `Referrer-Policy: no-referrer`; the browser UI
+  additionally ships a strict `Content-Security-Policy`
+  (`default-src 'none'; connect-src 'self'` — the page is self-contained).
+- **LAN-exposure warning:** `loom web --hostname 0.0.0.0` (or `::`) without
+  `LOOM_SERVER_PASSWORD` now prints an explicit warning that anyone on the
+  network can run an agent and reach its tools/files.
+- **New regression suite `src/tools/security.test.js`** plus five web-server
+  hardening tests (headers, CSP, token TTL expiry, Max-Age sync, logout).
+
+## [1.2.34] — bundle bun with the npm install
+
+### Added
+- **`npm i -g loom-agent` now brings its own bun.** The `@oven/bun-<platform>`
+  binaries (pinned to bun 1.3.14, the version the project builds against) ship
+  as `optionalDependencies`; npm downloads only the one matching the user's
+  OS/arch, and no install scripts are involved (npm allow-scripts policies
+  cannot break it). The postinstall rewrites the `loom` shims to prefer the
+  bundled binary, then `bun` from PATH.
+- **No-bun users are never stranded:** if neither the bundled binary nor a
+  PATH bun exists, the shim falls back to `node bin/loom.js` (the line-mode
+  REPL) with a hint — instead of dying with "'bun' is not recognized".
+  `findBun()` and the bin respawn paths check the bundled location first too.
+
 ## [1.2.33] — fix frozen splash on global installs + stable model picker
 
 ### Fixed

package/README.md

@@ -1,9 +1,18 @@
-# Loom Code
+```
+ ██╗      ██████╗  ██████╗ ███╗   ███╗      ██████╗ ██████╗ ██████╗ ███████╗
+ ██║     ██╔═══██╗██╔═══██╗████╗ ████║     ██╔════╝██╔═══██╗██╔══██╗██╔════╝
+ ██║     ██║   ██║██║   ██║██╔████╔██║     ██║     ██║   ██║██║  ██║█████╗
+ ██║     ██║   ██║██║   ██║██║╚██╔╝██║     ██║     ██║   ██║██║  ██║██╔══╝
+ ███████╗╚██████╔╝╚██████╔╝██║ ╚═╝ ██║     ╚██████╗██████╔╝██████╔╝███████╗
+ ╚══════╝ ╚═════╝  ╚═════╝ ╚═╝     ╚═╝      ╚═════╝╚═════╝ ╚═════╝ ╚══════╝
+```
 
 [![npm version](https://img.shields.io/npm/v/loom-agent?style=flat&color=blue)](https://www.npmjs.com/package/loom-agent)
 [![License: MIT](https://img.shields.io/npm/l/loom-agent?style=flat&color=green)](LICENSE)
 [![Platform: Win/Mac/Linux](https://img.shields.io/badge/platform-Win--Mac--Linux-orange)](#)
 
+![Loom Code splash — connected to NVIDIA](docs/screenshot.png)
+
 An AI-powered coding agent for the terminal with multi-provider support and a full terminal UI.
 
 ## Features

package/bin/loom-bun.js

@@ -1,68 +1,104 @@
-#!/usr/bin/env bun
-// npm invokes bin targets through Node on Windows, so re-launch under Bun
-// when this file was not started by Bun itself.
-const path = require("path");
-const fs = require("fs");
-const { spawnSync } = require("child_process");
-
-// The Solid JSX transform must register in Bun's preload phase, so the
-// preloads are passed as ABSOLUTE paths. That lets Bun start directly in the
-// user's project directory — the old "spawn at the package root, then chdir
-// to the project inside tui-open.tsx" dance froze the TUI after the first
-// frame (splash paints once, then no repaints and no keyboard input; proven
-// by A/B-launching the identical entry with and without the mid-flight
-// process.chdir). No chdir ever happens now: LOOM_START_CWD always equals
-// the starting directory, so the restore in tui-open.tsx is a no-op kept
-// only as a safety net.
-const pkgRoot = path.join(__dirname, "..");
-const underBun = typeof Bun !== "undefined" && !!process.versions.bun;
-if (!underBun) {
-  const result = spawnSync(
-    process.platform === "win32" ? "bun.exe" : "bun",
-    [
-      "--preload", path.join(pkgRoot, "src", "tui-preload.js"),
-      __filename,
-      ...process.argv.slice(2),
-    ],
-    {
-      stdio: "inherit",
-      cwd: process.env.LOOM_START_CWD || process.cwd(),
-      env: { ...process.env, LOOM_START_CWD: process.env.LOOM_START_CWD || process.cwd() },
-      windowsHide: false,
-    }
-  );
-  if (result.error) {
-    console.error("[loom] Bun is required for the full CLI. Install it from https://bun.sh/");
-    process.exit(1);
-  }
-  process.exit(result.status == null ? 1 : result.status);
-}
-process.title = "loom-code";
-(async () => {
-  try {
-    // The npm bin entry bypasses src/index.js, so load dotenv here for both
-    // the package environment and the project from which `loom` was run.
-    const dotenv = require("dotenv");
-    dotenv.config({ path: path.join(__dirname, "..", ".env") });
-    const startCwd = process.env.LOOM_START_CWD || process.cwd();
-    const projectEnv = path.join(startCwd, ".env");
-    if (fs.existsSync(projectEnv)) dotenv.config({ path: projectEnv, override: false });
-    // The npm global shim can start Bun outside the package directory, so do
-    // not depend on bunfig.toml discovery for Windows console setup.
-    await import("../src/tui-preload.js");
-    const args = process.argv.slice(2);
-    const coreMode = args.includes("--basic") || args.includes("-p") || args.includes("--print")
-      || args.includes("--help") || args.includes("-h") || args.includes("--version") || args.includes("-v")
-      || ["acp", "web", "attach", "graph"].includes(args[0]);
-    if (!coreMode) {
-      await import("@opentui/solid/preload");
-      await import("../src/tui-open.tsx");
-      return;
-    }
-    const { main } = require("../src/core/cli.js");
-    await main();
-  } catch (err) {
-    console.error(err && err.message ? err.message : String(err));
-    process.exit(1);
-  }
+#!/usr/bin/env bun
+// npm invokes bin targets through Node on Windows, so re-launch under Bun
+// when this file was not started by Bun itself.
+const path = require("path");
+const fs = require("fs");
+const { spawnSync } = require("child_process");
+
+// The Solid JSX transform must register in Bun's preload phase, so the
+// preloads are passed as ABSOLUTE paths. That lets Bun start directly in the
+// user's project directory — the old "spawn at the package root, then chdir
+// to the project inside tui-open.tsx" dance froze the TUI after the first
+// frame (splash paints once, then no repaints and no keyboard input; proven
+// by A/B-launching the identical entry with and without the mid-flight
+// process.chdir). No chdir ever happens now: LOOM_START_CWD always equals
+// the starting directory, so the restore in tui-open.tsx is a no-op kept
+// only as a safety net.
+const pkgRoot = path.join(__dirname, "..");
+const underBun = typeof Bun !== "undefined" && !!process.versions.bun;
+if (!underBun) {
+  // Prefer the bundled @oven bun binary (shipped as an optional dep), then
+  // whatever bun is on PATH. Without either, still respawn so the inner
+  // failure message can guide the user.
+  const OVEN = {
+    "win32-x64": "bun-windows-x64",
+    "win32-arm64": "bun-windows-aarch64",
+    "darwin-x64": "bun-darwin-x64",
+    "darwin-arm64": "bun-darwin-aarch64",
+    "linux-x64": "bun-linux-x64",
+    "linux-arm64": "bun-linux-aarch64",
+  };
+  let bunCmd = process.platform === "win32" ? "bun.exe" : "bun";
+  const short = OVEN[process.platform + "-" + process.arch];
+  const exe = process.platform === "win32" ? "bun.exe" : "bun";
+  const ovenCandidates = short ? [
+    path.join(pkgRoot, "node_modules", "@oven", short, "bin", exe),
+    path.join(pkgRoot, "..", "@oven", short, "bin", exe),
+  ] : [];
+  for (const c of ovenCandidates) {
+    if (fs.existsSync(c)) { bunCmd = c; break; }
+  }
+  const result = spawnSync(
+    bunCmd,
+    [
+      "--preload", path.join(pkgRoot, "src", "tui-preload.js"),
+      __filename,
+      ...process.argv.slice(2),
+    ],
+    {
+      stdio: "inherit",
+      cwd: process.env.LOOM_START_CWD || process.cwd(),
+      env: { ...process.env, LOOM_START_CWD: process.env.LOOM_START_CWD || process.cwd() },
+      windowsHide: false,
+    }
+  );
+  if (result.error) {
+    console.error("[loom] Bun is required for the full CLI. Install it from https://bun.sh/");
+    process.exit(1);
+  }
+  process.exit(result.status == null ? 1 : result.status);
+}
+process.title = "loom-code";
+(async () => {
+  try {
+    // The npm bin entry bypasses src/index.js, so load dotenv here for both
+    // the package environment and the project from which `loom` was run.
+    const dotenv = require("dotenv");
+    dotenv.config({ path: path.join(__dirname, "..", ".env") });
+    const startCwd = process.env.LOOM_START_CWD || process.cwd();
+    const projectEnv = path.join(startCwd, ".env");
+    if (fs.existsSync(projectEnv)) dotenv.config({ path: projectEnv, override: false });
+    // The npm global shim can start Bun outside the package directory, so do
+    // not depend on bunfig.toml discovery for Windows console setup.
+    await import("../src/tui-preload.js");
+    const args = process.argv.slice(2);
+    const coreMode = args.includes("--basic") || args.includes("-p") || args.includes("--print")
+      || args.includes("--help") || args.includes("-h") || args.includes("--version") || args.includes("-v")
+      || ["acp", "web", "attach", "graph"].includes(args[0]);
+    if (!coreMode) {
+      await import("@opentui/solid/preload");
+      await import("../src/tui-open.tsx");
+      return;
+    }
+    // Subcommands that must never reach the interactive CLI/TUI: cli.main()
+    // has no handler for them and would fall through to launching the full
+    // screen app (`loom web` painted the splash instead of serving HTTP).
+    if (args[0] === "web") {
+      require("../src/web/web-server.js").main();
+      return;
+    }
+    if (args[0] === "acp") {
+      require("../src/acp/acp-server.js").main();
+      return;
+    }
+    if (args[0] === "attach") {
+      require("../src/web/attach.js").main();
+      return;
+    }
+    const { main } = require("../src/core/cli.js");
+    await main();
+  } catch (err) {
+    console.error(err && err.message ? err.message : String(err));
+    process.exit(1);
+  }
 })();

package/bin/loom-tui.js

@@ -10,8 +10,28 @@ const { spawnSync } = require("child_process");
 const pkgRoot = path.join(__dirname, "..");
 const underBun = typeof Bun !== "undefined" && !!process.versions.bun;
 if (!underBun) {
+  // Prefer the bundled @oven bun binary (shipped as an optional dep), then
+  // whatever bun is on PATH — same scheme as bin/loom-bun.js.
+  const OVEN = {
+    "win32-x64": "bun-windows-x64",
+    "win32-arm64": "bun-windows-aarch64",
+    "darwin-x64": "bun-darwin-x64",
+    "darwin-arm64": "bun-darwin-aarch64",
+    "linux-x64": "bun-linux-x64",
+    "linux-arm64": "bun-linux-aarch64",
+  };
+  let bunCmd = process.platform === "win32" ? "bun.exe" : "bun";
+  const short = OVEN[process.platform + "-" + process.arch];
+  const exe = process.platform === "win32" ? "bun.exe" : "bun";
+  const ovenCandidates = short ? [
+    path.join(pkgRoot, "node_modules", "@oven", short, "bin", exe),
+    path.join(pkgRoot, "..", "@oven", short, "bin", exe),
+  ] : [];
+  for (const c of ovenCandidates) {
+    if (fs.existsSync(c)) { bunCmd = c; break; }
+  }
   const result = spawnSync(
-    process.platform === "win32" ? "bun.exe" : "bun",
+    bunCmd,
     [
       "--preload", path.join(pkgRoot, "src", "tui-preload.js"),
       __filename,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loom-agent",
-  "version": "1.2.33",
+  "version": "1.2.36",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/toshalkumbhar8979-design/loomcode.git"
@@ -24,7 +24,7 @@
     "dev": "node --watch src/index.js",
     "setup": "node src/setup.js",
     "test": "bun run src/tui/test-interactive.tsx && bun run test:unit && bun run lint:core",
-    "test:unit": "bun test src/core/agents.test.js src/core/hooks.test.js src/core/custom-commands.test.js src/core/background-tasks.test.js src/core/memory.test.js src/core/subagent-log.test.js src/core/session.test.js src/tools/index.test.js src/providers/providers.test.js src/providers/caching.test.js src/providers/caching-thinking.test.js src/providers/registry.test.js src/mcp/mcp-client.test.js src/mcp/mcp-manager.test.js src/core/session-store.test.js src/skills/skills-manager.test.js src/core/usage.test.js src/core/permissions.test.js src/core/format.test.js src/acp/acp-server.test.js src/web/web-server.test.js src/tui/keybinds.test.ts",
+    "test:unit": "bun test src/core/agents.test.js src/core/hooks.test.js src/core/custom-commands.test.js src/core/background-tasks.test.js src/core/memory.test.js src/core/subagent-log.test.js src/core/session.test.js src/tools/index.test.js src/tools/security.test.js src/providers/providers.test.js src/providers/caching.test.js src/providers/caching-thinking.test.js src/providers/registry.test.js src/mcp/mcp-client.test.js src/mcp/mcp-manager.test.js src/core/session-store.test.js src/skills/skills-manager.test.js src/core/usage.test.js src/core/permissions.test.js src/core/format.test.js src/acp/acp-server.test.js src/web/web-server.test.js src/tui/keybinds.test.ts",
     "lint:core": "node node_modules/typescript/bin/tsc -p tsconfig.core.json",
     "smoke:acp": "node scripts/acp-smoke.js",
     "tui": "bun bin/loom-tui.js",
@@ -62,7 +62,13 @@
     "@opentui/core-darwin-x64": "0.5.3",
     "@opentui/core-linux-arm64": "0.5.3",
     "@opentui/core-linux-x64": "0.5.3",
-    "@opentui/core-win32-x64": "0.5.3"
+    "@opentui/core-win32-x64": "0.5.3",
+    "@oven/bun-darwin-aarch64": "1.3.14",
+    "@oven/bun-darwin-x64": "1.3.14",
+    "@oven/bun-linux-aarch64": "1.3.14",
+    "@oven/bun-linux-x64": "1.3.14",
+    "@oven/bun-windows-aarch64": "1.3.14",
+    "@oven/bun-windows-x64": "1.3.14"
   },
   "overrides": {
     "glob": "^13.0.6"
@@ -115,6 +121,6 @@
     "doc": "docs"
   },
   "author": "",
-  "license": "ISC",
+  "license": "MIT",
   "type": "commonjs"
 }

package/scripts/postinstall.js

@@ -9,6 +9,40 @@ const path = require("path");
 
 const pkgRoot = path.resolve(__dirname, "..");
 
+// Bun, bundled: loom-agent lists the @oven/bun-<platform> binaries as
+// optionalDependencies, so `npm i -g loom-agent` brings the REAL bun binary
+// (pinned, matching the repo's bun) along even when the user has no bun
+// installed. npm skips non-matching platforms via each package's os/cpu
+// fields, and this resolution never needs install scripts (npm
+// allow-scripts policies can't break it). Resolved here once at install
+// time and baked into the shims as the preferred runtime; the shims still
+// fall back to whatever `bun` is on PATH, and — if NO bun exists at all —
+// to `node bin/loom.js` (line-mode REPL) instead of dying with
+// "'bun' is not recognized".
+function ovenBunPath() {
+    const PKGS = {
+        "win32-x64": "bun-windows-x64",
+        "win32-arm64": "bun-windows-aarch64",
+        "darwin-x64": "bun-darwin-x64",
+        "darwin-arm64": "bun-darwin-aarch64",
+        "linux-x64": "bun-linux-x64",
+        "linux-arm64": "bun-linux-aarch64",
+    };
+    const short = PKGS[process.platform + "-" + process.arch];
+    if (!short) return "";
+    const exe = process.platform === "win32" ? "bun.exe" : "bun";
+    const candidates = [
+        path.join(pkgRoot, "node_modules", "@oven", short, "bin", exe), // nested (npm default)
+        path.join(pkgRoot, "..", "@oven", short, "bin", exe),           // hoisted
+    ];
+    for (var i = 0; i < candidates.length; i++) {
+        try { if (fs.existsSync(candidates[i])) return candidates[i]; } catch {}
+    }
+    return "";
+}
+
+var ovenPath = "";
+
 function shimDirs() {
     const dirs = new Set();
     if (path.basename(path.resolve(pkgRoot, "..")) !== "node_modules") return [];
@@ -29,8 +63,11 @@ function cmdShim(pkg, script) {
         "@ECHO off",
         "SETLOCAL",
         'SET "LOOM_START_CWD=%CD%"',
-        'IF EXIST "%~dp0bun.exe" (SET "_prog=%~dp0bun.exe") ELSE (SET "_prog=bun")',
+        'IF EXIST "' + ovenPath + '" (SET "_prog=' + ovenPath + '") ELSE (SET "_prog=bun")',
         '"%_prog%" --preload "%~dp0' + pkgEscaped + '\\src\\tui-preload.js" "%~dp0' + pkgEscaped + '\\bin\\' + script + '" %*',
+        "IF %ERRORLEVEL% NEQ 9009 EXIT /b %ERRORLEVEL%",
+        "REM bun not found (errorlevel 9009): fall back to the Node REPL",
+        "node \"%~dp0" + pkgEscaped + "\\bin\\loom.js\" %*",
         "EXIT /b %ERRORLEVEL%",
         ""
     ].join("\r\n");
@@ -39,10 +76,13 @@ function cmdShim(pkg, script) {
 function psShim(pkg, script) {
     return [
         "#!/usr/bin/env pwsh",
-        "# rewritten by loom-agent postinstall (no-cwd-change TUI launch)",
+        "# rewritten by loom-agent postinstall (bundled bun + node fallback)",
         "$env:LOOM_START_CWD = (Get-Location).Path",
         "$pkg = Join-Path $PSScriptRoot '" + pkg + "'",
-        "& bun --preload (Join-Path $pkg 'src/tui-preload.js') (Join-Path $pkg 'bin/" + script + "') @args",
+        "$bun = '" + ovenPath + "'",
+        "if (-not ($bun -and (Test-Path $bun))) { $bun = 'bun' }",
+        "& $bun --preload (Join-Path $pkg 'src/tui-preload.js') (Join-Path $pkg 'bin/" + script + "') @args",
+        "if ($LASTEXITCODE -eq 9009) { node (Join-Path $pkg 'bin/loom.js') @args; exit $LASTEXITCODE }",
         "exit $LASTEXITCODE",
         ""
     ].join("\n");
@@ -51,16 +91,28 @@ function psShim(pkg, script) {
 function shShim(pkg, script) {
     return [
         "#!/bin/sh",
-        "# rewritten by loom-agent postinstall (no-cwd-change TUI launch)",
+        "# rewritten by loom-agent postinstall (bundled bun + node fallback)",
         'LOOM_START_CWD="$(pwd)"',
         "export LOOM_START_CWD",
         'PKG="$(dirname "$0")/' + pkg + '"',
-        'exec bun --preload "$PKG/src/tui-preload.js" "$PKG/bin/' + script + '" "$@"',
+        'BUN="' + ovenPath + '"',
+        '[ -x "$BUN" ] || BUN="$(command -v bun || true)"',
+        'if [ -n "$BUN" ]; then',
+        '  exec "$BUN" --preload "$PKG/src/tui-preload.js" "$PKG/bin/' + script + '" "$@"',
+        "fi",
+        'echo "[loom] full TUI needs bun - install with: npm i -g bun (https://bun.sh)" >&2',
+        'exec node "$PKG/bin/loom.js" "$@"',
         ""
     ].join("\n");
 }
 
 try {
+    ovenPath = ovenBunPath();
+    if (ovenPath) {
+        console.log("[loom-agent] bundled bun found: " + ovenPath);
+    } else {
+        console.log("[loom-agent] bundled bun not present for " + process.platform + "-" + process.arch + " (optional dep skipped?) - shims will use bun from PATH, or fall back to the Node REPL");
+    }
     for (var i = 0; i < shimDirs().length; i++) {
         var dir = shimDirs()[i];
         var relPkg = path.relative(dir, pkgRoot).split(path.sep).join("/");

package/src/core/cli.js

@@ -460,7 +460,31 @@ class LoomCLI {
 }
 
 function findBun() {
-  // Check common installation paths
+  // 1. The bundled bun binary shipped via @oven/bun-<platform> optional deps
+  //    (npm i -g loom-agent brings its own bun — works with zero setup).
+  try {
+    const PKGS = {
+      'win32-x64': 'bun-windows-x64',
+      'win32-arm64': 'bun-windows-aarch64',
+      'darwin-x64': 'bun-darwin-x64',
+      'darwin-arm64': 'bun-darwin-aarch64',
+      'linux-x64': 'bun-linux-x64',
+      'linux-arm64': 'bun-linux-aarch64',
+    };
+    const short = PKGS[process.platform + '-' + process.arch];
+    if (short) {
+      const exe = process.platform === 'win32' ? 'bun.exe' : 'bun';
+      const pkgRoot = path.join(__dirname, '..', '..');
+      const candidates = [
+        path.join(pkgRoot, 'node_modules', '@oven', short, 'bin', exe), // nested
+        path.join(pkgRoot, '..', '@oven', short, 'bin', exe),           // hoisted
+      ];
+      for (const c of candidates) {
+        if (fs.existsSync(c)) return c;
+      }
+    }
+  } catch {}
+  // 2. Common installation paths
   const paths = [
     path.join(os.homedir(), '.bun', 'bin', 'bun.exe'),
     path.join(os.homedir(), '.bun', 'bin', 'bun'),
@@ -471,7 +495,7 @@ function findBun() {
   for (const p of paths) {
     if (fs.existsSync(p)) return p;
   }
-  // Search PATH (Windows: where.exe, POSIX: which)
+  // 3. Search PATH (Windows: where.exe, POSIX: which)
   try {
     const { execSync } = require('child_process');
     const isWin = process.platform === 'win32';

package/src/mcp/mcp-client.js

@@ -1,4 +1,34 @@
 const { spawn } = require('child_process');
+// Minimal OS/runtime baseline handed to every spawned MCP server (see note in
+// connectToJson). Explicit cfg.env keys are layered on top per server.
+const MCP_ENV_KEYS = [
+  'PATH', 'PATHEXT', 'COMSPEC', 'SystemRoot', 'windir', 'SystemDrive',
+  'TEMP', 'TMP', 'HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA',
+  'PROGRAMFILES', 'PROGRAMDATA', 'ALLUSERSPROFILE', 'COMMONPROGRAMFILES',
+  'PROCESSOR_ARCHITECTURE', 'NUMBER_OF_PROCESSORS', 'OS',
+  'COMPUTERNAME', 'USERNAME', 'LANG', 'TZ', 'TERM', 'SHELL',
+  'XDG_CONFIG_HOME', 'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY',
+];
+/** @returns {Record<string,string>} filtered copy of process.env */
+function buildMcpBaseEnv() {
+  const out = /** @type {Record<string,string>} */ ({});
+  for (const k of MCP_ENV_KEYS) {
+    const v = process.env[k];
+    if (v !== undefined) out[k] = v;
+  }
+  return out;
+}
+const MCP_BASE_ENV = buildMcpBaseEnv();
+
+/**
+ * Compose the environment for one MCP server process: the filtered baseline
+ * plus whatever that server's config explicitly declares (cfg.env wins).
+ * @param {{env?: Record<string,string|undefined>|null}} cfg
+ * @returns {Record<string,string>}
+ */
+function mcpSpawnEnv(cfg) {
+  return Object.assign({}, MCP_BASE_ENV, cfg.env || {});
+}
 const { loadServers } = require('./mcp-manager');
 
 let toolCachePromise = null;
@@ -22,9 +52,19 @@ function killTree(child) {
 
 function connectToJson(cfg, timeoutMs) {
   return new Promise((resolve, reject) => {
+    // MCP servers are third-party processes. Inheriting the parent's FULL
+    // environment would hand every provider API key / cloud token / cookie in
+    // the user's shell to whatever npm package a config spawns. Instead pass a
+    // minimal OS/runtime baseline plus only what cfg.env explicitly declares —
+    // per-server secrets belong in the server's own env config, not leaked by
+    // inheritance. (network proxies forwarded; they carry routing, not auth.)
+    // Per-server environment via allowlist + explicit cfg.env only — see
+    // buildMcpBaseEnv/mcpSpawnEnv above; inheriting all of process.env would
+    // leak provider keys to every third-party server.
+    const env = mcpSpawnEnv(cfg);
     const child = spawn(cfg.command, cfg.args || [], {
       stdio: ['pipe', 'pipe', 'pipe'],
-      env: Object.assign({}, process.env, cfg.env || {}),
+      env,
       // No console window for stdio MCP servers: on Windows spawn() would
       // otherwise pop a flashing console up and down while chats happen.
       windowsHide: true,
@@ -198,4 +238,4 @@ function getCachedTools() {
   return warm();
 }
 
-module.exports = { getTools, getCachedTools, clearCache, buildToolName, callTool, warm, callRpc, killTree };
+module.exports = { getTools, getCachedTools, clearCache, buildToolName, callTool, warm, callRpc, killTree, buildMcpBaseEnv, mcpSpawnEnv };

package/src/skills/skills-manager.js

@@ -11,6 +11,19 @@ function validateUrl(url) {
   } catch { return false; }
 }
 
+/**
+ * Reduce an install target to a single safe folder name under ~/.loom/skills.
+ * Strict allowlist (alnum/_/./-, ≤64 chars): drives, separators and '..'
+ * segments are rejected outright, never silently collapsed, so remote-provided
+ * names can't rename unexpectedly or point outside the skills directory.
+ * @param {unknown} name
+ * @returns {string|null} cleaned single-segment name, or null when unusable
+ */
+function safeSkillName(name) {
+  const s = typeof name === 'string' ? name.trim() : '';
+  return /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/.test(s) ? s : null;
+}
+
 const LOOM_DIR = path.join(os.homedir(), '.loom');
 
 function globalSkillsDir() {
@@ -111,8 +124,17 @@ function installFrom(srcDir, targetName) {
   if (!fs.existsSync(path.join(src, 'SKILL.md'))) {
     return { error: `No SKILL.md in ${src}` };
   }
-  const name = targetName || path.basename(src);
-  const dest = path.join(globalSkillsDir(), name);
+  const name = safeSkillName(targetName != null ? targetName : path.basename(src));
+  if (!name) {
+    return { error: `Invalid skill name: ${JSON.stringify(targetName)} — use letters/digits/-/_ only` };
+  }
+  const destRoot = globalSkillsDir();
+  const dest = path.join(destRoot, name);
+  // Paranoia check: `name` is already a sanitized single segment, so this can
+  // not trip short of path.join behavior changing underneath us.
+  if (path.resolve(dest) !== path.join(path.resolve(destRoot), name)) {
+    return { error: 'Invalid install location' };
+  }
   if (fs.existsSync(dest)) {
     fs.rmSync(dest, { recursive: true, force: true });
   }
@@ -210,4 +232,5 @@ module.exports = {
   globalSkillsDir,
   agentsSkillsDir,
   projectSkillsDir,
+  safeSkillName,
 };

package/src/tools/index.js

@@ -5,6 +5,7 @@ const { execSync, spawn } = require('child_process');
 const { glob: globLib } = require('glob');
 const { commandRiskLabel } = require('../core/permissions');
 const { loadConfig } = require('../config/settings');
+const dnsPromises = require('dns').promises;
 
 const cwd = process.cwd();
 
@@ -15,6 +16,74 @@ function globIgnore(full) {
   return ['node_modules', '.git'].map((n) => path.posix.join(base, '**', n, '**'));
 }
 
+// ---------------------------------------------------------------------------
+// SSRF guard (webfetch)
+//
+// The agent model decides which URLs webfetch opens, and prompt-injected page
+// content can steer it toward "check http://169.254.169.254/latest/meta-data"
+// or "read localhost:5984/_config". Those must fail closed:
+//   - only http/https, never file:/ftp:/data: transport tricks
+//   - loopback, link-local (cloud metadata!), RFC1918 private ranges, CGNAT,
+//     IPv6 ULA/link-local and IPv4-mapped addresses are refused
+//   - hostnames are resolved BEFORE connecting so a DNS name pointing into
+//     internal space is caught (checking the literal hostname is not enough)
+//   - redirects are followed manually and every hop re-checked, because a
+//     public URL can bounce straight at an internal one
+// ---------------------------------------------------------------------------
+/**
+ * True when an IPv4/IPv6 address string falls in a range the agent must never
+ * fetch (loopback, link-local/metadata, private, CGNAT, malformed).
+ * @param {string} ip
+ * @returns {boolean}
+ */
+function isPrivateAddress(ip) {
+  const s = String(ip || '').toLowerCase();
+  // IPv6 handling first: exact forms and prefix families we care about.
+  if (s.includes(':')) {
+    let bare = s.replace(/^\[|\]$/g, '');
+    if (bare === '::' || bare === '::1') return true;
+    const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(bare);
+    if (mapped) return isPrivateAddress(mapped[1]);
+    if (/^f[cd][0-9a-f]{2}:/.test(bare)) return true;      // fc00::/7 ULA
+    if (/^fe[89ab][0-9a-f]:/.test(bare)) return true;      // fe80::/10 link-local
+    if (/^2001:db8:/.test(bare)) return true;              // documentation
+    return false;
+  }
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(s);
+  if (!m) return false;
+  const o = m.slice(1).map(Number);
+  if (o.some((x) => x > 255)) return true;                 // malformed → refuse
+  const [a, b] = o;
+  return (
+    a === 0 ||                                             // this-network
+    a === 10 ||                                            // RFC1918
+    a === 127 ||                                           // loopback
+    (a === 100 && b >= 64 && b <= 127) ||                  // CGNAT 100.64/10
+    (a === 169 && b === 254) ||                            // link-local / metadata
+    (a === 172 && b >= 16 && b <= 31) ||                   // RFC1918
+    (a === 192 && b === 168)                               // RFC1918
+  );
+}
+
+/**
+ * Resolve a URL's host and report whether every resolved address is public.
+ * Unresolvable hosts fail closed (false).
+ * @param {URL} u
+ * @returns {Promise<boolean>}
+ */
+async function urlIsPublic(u) {
+  const host = u.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+  if (!host || host === 'localhost' || host.endsWith('.localhost')) return false;
+  if (isPrivateAddress(host)) return false;
+  let addrs;
+  try {
+    addrs = /** @type {{address: string}[]} */ (await dnsPromises.lookup(host, { all: true }));
+  } catch {
+    return false;
+  }
+  return addrs.length > 0 && addrs.every((a) => !isPrivateAddress(a.address));
+}
+
 const MODES = ['build', 'plan', 'chat'];
 
 // Tools that never mutate the filesystem/state — safe to expose in plan mode.
@@ -251,10 +320,36 @@ const TOOLS = {
       url: { type: 'string', required: true, description: 'URL to fetch' },
     },
     async execute(params) {
+      let u;
       try {
-        const resp = await fetch(params.url, { signal: AbortSignal.timeout(15000) });
-        const text = await resp.text();
-        return text.slice(0, 10000);
+        u = new URL(String(params.url || ''));
+      } catch {
+        return { error: 'Invalid URL' };
+      }
+      if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        return { error: 'Blocked by webfetch policy: only http/https URLs are allowed' };
+      }
+      try {
+        // Follow redirects manually so every hop passes the SSRF guard — a
+        // public URL may legitimately bounce into an internal address.
+        let current = u;
+        const signal = AbortSignal.timeout(15000);
+        for (let hop = 0; hop < 5; hop++) {
+          if (!(await urlIsPublic(current))) {
+            return { error: `Blocked by webfetch policy: ${current.hostname} resolves to a private/reserved address (SSRF guard)` };
+          }
+          const resp = await fetch(current.toString(), { redirect: 'manual', signal });
+          if ([301, 302, 303, 307, 308].includes(resp.status)) {
+            const loc = resp.headers.get('location');
+            try { resp.body && resp.body.cancel(); } catch {}
+            if (!loc) return { error: `Fetch failed: redirect ${resp.status} without Location header` };
+            current = new URL(loc, current);
+            continue;
+          }
+          const text = await resp.text();
+          return text.slice(0, 10000);
+        }
+        return { error: 'Fetch failed: too many redirects' };
       } catch (e) {
         return { error: `Fetch failed: ${e.message}` };
       }
@@ -540,4 +635,4 @@ async function getAllToolDefinitions(mode = 'build') {
   }
 }
 
-module.exports = { TOOLS, MODES, READ_ONLY_TOOLS, getToolDefinitions, getAllToolDefinitions, executeTool };
+module.exports = { TOOLS, MODES, READ_ONLY_TOOLS, getToolDefinitions, getAllToolDefinitions, executeTool, isPrivateAddress };

package/src/web/web-server.js

@@ -111,22 +111,47 @@ function readBody(req, limit = 1_048_576) {
 
 function sendJson(res, status, obj) {
   const body = JSON.stringify(obj);
-  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': Buffer.byteLength(body) });
+  res.writeHead(status, Object.assign(securityHeaders(), {
+    'Content-Type': 'application/json; charset=utf-8',
+    'Content-Length': Buffer.byteLength(body),
+  }));
   res.end(body);
 }
 
 function sendText(res, status, text, extra) {
-  const headers = Object.assign({ 'Content-Type': 'text/plain; charset=utf-8', 'Content-Length': Buffer.byteLength(text) }, extra || {});
+  const headers = Object.assign(securityHeaders(), {
+    'Content-Type': 'text/plain; charset=utf-8',
+    'Content-Length': Buffer.byteLength(text),
+  }, extra || {});
   res.writeHead(status, headers);
   res.end(text);
 }
 
+// Baseline hardening on every response: stops MIME sniffing, clickjacking
+// and referrer leakage. The API is JSON-only and index.html is a single
+// self-contained page (one inline script, no external assets), so this
+// cannot break the UI.
+const SECURITY_HEADERS = {
+  'X-Content-Type-Options': 'nosniff',
+  'X-Frame-Options': 'DENY',
+  'Referrer-Policy': 'no-referrer',
+};
+const HTML_SECURITY_HEADERS = Object.assign({}, SECURITY_HEADERS, {
+  'Content-Security-Policy': "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src 'self' data:; connect-src 'self'",
+});
+/** @returns {Record<string,string>} fresh copy so callers can extend safely */
+function securityHeaders() {
+  return Object.assign({}, SECURITY_HEADERS);
+}
+
 // ── The web server ──────────────────────────────────────────────────────
 
 function createWebServer(opts) {
-  const tokens = new Map(); // token -> true (in-memory auth, server-lifetime)
+  const tokens = new Map(); // token -> issued-at ms (auth is server-lifetime, per-token TTL)
   const password = process.env.LOOM_SERVER_PASSWORD || '';
   const username = process.env.LOOM_SERVER_USERNAME || DEFAULT_USERNAME;
+  const tokenTtlMs =
+    Number((opts && opts.tokenTtlMs) || process.env.LOOM_SERVER_TOKEN_TTL_MS) || 12 * 60 * 60 * 1000;
   const hub = new Map(); // sessionId -> { session, active }
   const stats = { requests: 0, sessionsCreated: 0, messagesRun: 0 };
   const authFails = new Map(); // ip -> { count, lockedUntil }
@@ -173,10 +198,27 @@ function createWebServer(opts) {
 
   function authOk(req) {
     if (!password) return true;
+    sweepTokens();
     const cookieHeader = req.headers.cookie || '';
     const token = /(?:^|;\s*)loom_token=([^;\s]+)/.exec(cookieHeader)?.[1]
       || new URL(req.url, 'http://x').searchParams.get('token');
-    return !!(token && tokens.has(token));
+    return !!(token && tokenIsLive(token));
+  }
+
+  // Tokens are stamped at issue time and expire after tokenTtlMs (default 12h,
+  // env LOOM_SERVER_TOKEN_TTL_MS). Sweep runs opportunistically on each auth
+  // check — the map holds only this server's logins, so it stays tiny.
+  function tokenIsLive(token) {
+    const issuedAt = tokens.get(token);
+    if (typeof issuedAt !== 'number') return false;
+    return Date.now() - issuedAt <= tokenTtlMs && Date.now() >= issuedAt - 60_000;
+  }
+  function sweepTokens() {
+    if (!tokens.size) return;
+    const now = Date.now();
+    for (const [tok, issuedAt] of tokens) {
+      if (typeof issuedAt === 'number' && now - issuedAt > tokenTtlMs) tokens.delete(tok);
+    }
   }
 
   function requireAuth(req, res) {
@@ -266,8 +308,8 @@ function createWebServer(opts) {
           if (body.username === username && passwordMatches(body.password, password)) {
             authFails.delete(ip);
             const token = crypto.randomBytes(24).toString('hex');
-            tokens.set(token, true);
-            res.setHeader('Set-Cookie', 'loom_token=' + token + '; Path=/; HttpOnly; SameSite=Strict');
+            tokens.set(token, Date.now());
+            res.setHeader('Set-Cookie', 'loom_token=' + token + '; Path=/; HttpOnly; SameSite=Strict; Max-Age=' + Math.floor(tokenTtlMs / 1000));
             return sendJson(res, 200, { ok: true, username });
           }
           authAttemptFailed(ip);
@@ -277,6 +319,16 @@ function createWebServer(opts) {
       return sendJson(res, 200, { required: !password ? false : true, username: password ? username : null });
     }
 
+    // POST /api/auth/logout — revoke the presented session token immediately.
+    if (seg[0] === 'api' && seg.length === 3 && seg[1] === 'auth' && seg[2] === 'logout') {
+      if (req.method !== 'POST') return sendJson(res, 405, { error: 'method not allowed' });
+      const cookieHeader = req.headers.cookie || '';
+      const token = /(?:^|;\s*)loom_token=([^;\s]+)/.exec(cookieHeader)?.[1];
+      if (token) tokens.delete(token);
+      res.setHeader('Set-Cookie', 'loom_token=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0');
+      return sendJson(res, 200, { ok: true });
+    }
+
     if (seg[0] === 'api' && seg[1] === 'health') return sendJson(res, 200, { ok: true });
 
     if (!requireAuth(req, res)) return;
@@ -371,7 +423,10 @@ function createWebServer(opts) {
     if (p === '/' || p === '/index.html') {
       fs.readFile(INDEX_FILE, 'utf8', (err, html) => {
         if (err) return sendText(res, 500, 'index.html missing: ' + err.message);
-        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Content-Length': Buffer.byteLength(html) });
+        res.writeHead(200, Object.assign(HTML_SECURITY_HEADERS, {
+          'Content-Type': 'text/html; charset=utf-8',
+          'Content-Length': Buffer.byteLength(html),
+        }));
         res.end(html);
       });
       return;
@@ -445,6 +500,16 @@ async function main() {
 
   console.log('Loom Web — version ' + require('../../package.json').version);
   if (o.password) console.log('Authentication required — user: ' + o.username + ' (LOOM_SERVER_USERNAME)');
+  const exposedToLan = o.hostname === '0.0.0.0' || o.hostname === '::';
+  if (exposedToLan) {
+    console.log('! NETWORK EXPOSURE WARNING !');
+    if (!o.password) {
+      console.log('! Binding ' + o.hostname + ' WITHOUT a password: anyone on your LAN can run an AI agent ');
+      console.log('! on this machine and reach its tools/files. Set LOOM_SERVER_PASSWORD before exposing.');
+    } else {
+      console.log('! Bound to ' + o.hostname + ' — protected by login, but keep the port firewalled where possible.');
+    }
+  }
   for (const a of addresses) console.log('  ' + a.label + ':      ' + a.url);
   if (o.mdns) {
     const m = advertiseMdns(o, port, (msg) => console.error('[loom web] ' + msg));