memgineering 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -11,6 +11,59 @@ language the reader wants. The bilingual rule the monorepo applies to
 
 ## [Unreleased]
 
+## [0.4.2] — 2026-08-10
+
+### Fixed
+
+- **`setup --web` no longer prints the install key where it will be kept.** The
+  URL carries the key that authorizes reading your folders and writing into
+  `~/.claude`, and it was printed on every run — including under `--json`, so a
+  copy landed in the transcript of the agent that ran the command, which may be
+  stored, synced, or sent somewhere. It is now shown only when it is the way
+  in: the browser did not open, or you asked for it with `--print-url`.
+
+  **If you parse `--json`:** `url` is now present only when `opened` is
+  `false`. `port` and `opened` are always there. This is a smaller promise than
+  before and it is deliberate — the alternative was to keep handing out the key
+  to avoid changing a field.
+
+- **The link is no longer described as working "only once".** It never did: the
+  key is single-use for applying the setup and reusable for reading, so a
+  person told "only once" and then able to reload had been told something
+  untrue about the thing protecting their machine. It now says what actually
+  ends it — applying, closing the tab, or an hour.
+
+## [0.4.1] — 2026-08-10
+
+Security fixes in `setup --web`, from the 2026-08-09 audit
+(`docs/security-audit-2026-08-09.md`). Every one was reproduced against
+0.3.0/0.4.0 rather than reasoned about. No command or flag changed.
+
+### Fixed
+
+- **The setup screen no longer stays up for whoever is knocking.** Its idle
+  timer was reset before any request was checked, so anything that could reach
+  the port kept a writable install endpoint alive by pinging it — without ever
+  presenting the key. The timer now moves only for requests that passed the
+  origin and key checks, and there is a one-hour ceiling above it that nothing
+  can push back.
+- **`--web` no longer reads a folder you did not mean.** Pointed at a system
+  directory it walked one and returned the title and first paragraph of every
+  markdown file under it. System folders are refused, the scan stops after
+  5,000 notes rather than running for minutes on a large folder with no way to
+  cancel, and the folder step stops answering once the install is done.
+- **A second submit no longer reports a failed install that succeeded.** Two
+  applies — the ordinary case of opening the setup link in a second tab —
+  both got past the already-applied guard, and the loser was told "Nothing
+  further was written" while everything had been written.
+- **The screen cannot be embedded in another page**, and a request that changes
+  something must say where it came from.
+- **`--web` no longer claims it opened a browser when it did not.** On a machine
+  with no default browser — or a sandbox, or `xdg-open` with nothing to hand it
+  — the opener exits non-zero and this reported success anyway, so an agent told
+  its user the screen was open while the desktop was unchanged and the printed
+  URL was the only way forward.
+
 ## [0.4.0] — 2026-08-10
 
 A template is not an answer, a revision that revises nothing is not written,

package/dist/index.js

@@ -4122,6 +4122,7 @@ var init_setup_web_page = __esm({
 var setup_web_exports = {};
 __export(setup_web_exports, {
   browserOpener: () => browserOpener,
+  disclosure: () => disclosure,
   runSetupWeb: () => runSetupWeb,
   startSetupWebServer: () => startSetupWebServer
 });
@@ -4130,10 +4131,11 @@ import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
 import { readdir as readdir6, stat as stat3 } from "fs/promises";
 import { createServer } from "http";
 import { homedir as homedir3 } from "os";
-import { basename, isAbsolute as isAbsolute2, join as join14, resolve as resolve7 } from "path";
+import { basename, isAbsolute as isAbsolute2, join as join14, relative as relative2, resolve as resolve7 } from "path";
 async function startSetupWebServer(opts) {
   const token = randomBytes2(32).toString("hex");
   const idleMs = opts.idleMs ?? IDLE_TIMEOUT_MS;
+  const maxMs = opts.maxMs ?? MAX_LIFETIME_MS;
   const lingerMs = opts.lingerMs ?? APPLY_LINGER_MS;
   const sockets = /* @__PURE__ */ new Set();
   const server = createServer();
@@ -4162,6 +4164,7 @@ async function startSetupWebServer(opts) {
     if (stopped) return;
     stopped = true;
     if (idleTimer) clearTimeout(idleTimer);
+    clearTimeout(maxTimer);
     process.off("SIGINT", onInterrupt);
     await new Promise((resolve10) => {
       server.close(() => resolve10());
@@ -4175,14 +4178,15 @@ async function startSetupWebServer(opts) {
     idleTimer = setTimeout(() => void stop("idle"), idleMs);
     idleTimer.unref();
   };
+  const maxTimer = setTimeout(() => void stop("idle"), maxMs);
+  maxTimer.unref();
   function onInterrupt() {
     void stop("interrupted");
   }
   process.once("SIGINT", onInterrupt);
   const state = { detected: opts.detected, token, ownOrigins, applied: false };
   server.on("request", (req, res) => {
-    touch();
-    void handle(req, res, state, origin).then((outcome) => {
+    void handle(req, res, state, origin, touch).then((outcome) => {
       if (outcome === "applied") setTimeout(() => void stop("applied"), lingerMs).unref();
       if (outcome === "cancelled") setTimeout(() => void stop("cancelled"), 50).unref();
     }).catch((err) => {
@@ -4209,18 +4213,32 @@ async function runSetupWeb(opts) {
   const server = await startSetupWebServer({ detected: opts.detected });
   const opened = opts.printUrl ? false : await openBrowser(server.url);
   printDual({
-    json: { url: server.url, port: server.port, opened },
+    // The URL carries the key that authorizes reading folders and writing into
+    // `~/.claude`, and it was printed on every run — in `--json` too, so it
+    // landed in the transcript of the agent that ran the command, which may be
+    // stored, synced or sent somewhere. That is a different exposure from the
+    // one everybody thinks of with a local token: not a process on this machine
+    // that could read those files anyway, but a copy of the key leaving it.
+    //
+    // So it is emitted only when it is the way in — the browser did not open,
+    // or `--print-url` asked for it. When the browser DID open, the person is
+    // already looking at the screen and nobody needs the string.
+    json: disclosure(server.url, server.port, opened),
     human: () => {
       if (opened) {
         printHuman("Opened setup in your browser.\n");
-        printHuman(c.gray(`  If nothing appeared: ${server.url}`));
+        printHuman(
+          c.gray(
+            "  Nothing appeared? Run `memgineering setup --web --print-url` and open\n  the link yourself \u2014 it is not printed here on purpose, because it\n  carries the key that authorizes the install."
+          )
+        );
       } else {
         printHuman("Open this in a browser to finish setting up:\n");
         printHuman(`  ${server.url}`);
       }
       printHuman(
         c.gray(
-          "\n  The link only works on this machine and only once \u2014 it carries a\n  one-time key, and this screen closes when you are done.\n  Ctrl-C to stop waiting."
+          "\n  The link works only on this machine, and only until this screen\n  closes \u2014 applying the setup, closing the tab, or an hour, whichever\n  comes first. Ctrl-C to stop waiting."
         )
       );
     }
@@ -4237,9 +4255,23 @@ async function runSetupWeb(opts) {
   else printHuman(`
 ${reason === "applied" ? c.green(ending[reason]) : c.gray(ending[reason])}`);
 }
-async function handle(req, res, state, origin) {
+function disclosure(url, port, opened) {
+  return opened ? { port, opened } : { port, opened, url };
+}
+async function handle(req, res, state, origin, touch = () => {
+}) {
   const url = new URL(req.url ?? "/", origin);
   const sender = req.headers.origin;
+  if (sender === void 0 && req.method !== "GET" && req.method !== "HEAD") {
+    sendJson(res, 403, {
+      error: {
+        code: "forbidden_origin",
+        message: "a request that changes something must say where it came from",
+        hint: "This screen answers the page it opened on this machine. If you are driving it directly, send `Origin` matching the URL `memgineering setup --web` printed."
+      }
+    });
+    return "served";
+  }
   if (sender !== void 0 && !state.ownOrigins.has(sender)) {
     sendJson(res, 403, {
       error: {
@@ -4260,6 +4292,7 @@ async function handle(req, res, state, origin) {
     });
     return "served";
   }
+  touch();
   if (req.method === "GET" && url.pathname === "/") {
     sendHtml(res, renderSetupPage());
     return "served";
@@ -4277,7 +4310,7 @@ async function handle(req, res, state, origin) {
     return "served";
   }
   if (req.method === "POST" && url.pathname === "/api/inspect") {
-    return inspectFromScreen(req, res);
+    return inspectFromScreen(req, res, state);
   }
   if (req.method === "POST" && url.pathname === "/api/apply") {
     return applyFromScreen(req, res, state);
@@ -4354,7 +4387,24 @@ async function holdsNotes(dir) {
   }
   return false;
 }
-async function inspectFromScreen(req, res) {
+function isSystemPath(path) {
+  return SYSTEM_ROOTS.some((root) => {
+    if (root === "/") return path === "/";
+    const rel = relative2(root, path);
+    return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+  });
+}
+async function inspectFromScreen(req, res, state) {
+  if (state.applied) {
+    sendJson(res, 409, {
+      error: {
+        code: "already_applied",
+        message: "setup is finished \u2014 this screen no longer reads folders",
+        hint: "Run `memgineering link <folder>` to connect another set of notes, or `memgineering setup --web` again."
+      }
+    });
+    return "served";
+  }
   const parsed = await readJsonBody(req, res);
   if (parsed === void 0) return "served";
   const asked = parsed.path;
@@ -4368,7 +4418,17 @@ async function inspectFromScreen(req, res) {
     });
     return "served";
   }
-  const path = expandHome(asked.trim());
+  const path = resolve7(expandHome(asked.trim()));
+  if (isSystemPath(path)) {
+    sendJson(res, 400, {
+      error: {
+        code: "invalid_input",
+        message: `that is a system folder, not a notes folder: ${path}`,
+        hint: "Point this at the FOLDER holding your notes \u2014 somewhere you write, like `~/Documents/Notes`."
+      }
+    });
+    return "served";
+  }
   const info = await stat3(path).catch(() => null);
   if (info === null) {
     sendJson(res, 200, {
@@ -4390,7 +4450,8 @@ async function inspectFromScreen(req, res) {
   }
   try {
     const target = await openLinkTarget(path, { quiet: true });
-    const rows = await target.preview(Number.MAX_SAFE_INTEGER);
+    const rows = await target.preview(PREVIEW_CAP);
+    const capped = target.notes.length > PREVIEW_CAP;
     const cfg = await loadConfig();
     sendJson(res, 200, {
       path,
@@ -4401,6 +4462,10 @@ async function inspectFromScreen(req, res) {
       // number is the one a person is agreeing to; the first is why it moved.
       scanned: target.notes.length,
       would_index: rows.length,
+      // Named, so a number that stopped early is never read as a total. The
+      // screen shows what a person is agreeing to, and "5,000" presented as the
+      // whole of a 24,000-note folder is a worse answer than a slow one.
+      ...capped ? { would_index_capped: PREVIEW_CAP } : {},
       excluded: target.scan.excluded.length,
       skipped_symlinks: target.scan.skippedSymlinks.length,
       refused: [
@@ -4430,14 +4495,18 @@ async function applyFromScreen(req, res, state) {
     });
     return "served";
   }
+  state.applied = true;
   const parsed = await readJsonBody(req, res);
-  if (parsed === void 0) return "served";
+  if (parsed === void 0) {
+    state.applied = false;
+    return "served";
+  }
   const choice = readChoice(parsed, state.detected);
   if ("error" in choice) {
+    state.applied = false;
     sendJson(res, 400, { error: choice.error });
     return "served";
   }
-  state.applied = true;
   const changes = await applySetup(choice.value, false);
   const brain = await connectBrain(choice.brain);
   const cfg = await loadConfig();
@@ -4656,17 +4725,34 @@ function sendHtml(res, html) {
     // The page is one self-contained file by design; say so, so that a future
     // edit that reaches for a CDN font fails visibly here instead of quietly
     // making a local setup screen talk to the internet.
-    "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; form-action 'none'; base-uri 'none'"
+    // `frame-ancestors 'none'` because a hostile page could and did load this
+    // screen in an iframe. Nothing is exploitable through it while the token
+    // stands between an attacker and the API — but the consent screen for
+    // installing into somebody's agent should not be embeddable, and the day
+    // the token moves out of the URL into a cookie it would become the whole
+    // attack rather than a curiosity.
+    "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'",
+    // The header the older browsers read. Same statement, twice.
+    "x-frame-options": "DENY"
   });
   res.end(html);
 }
 async function openBrowser(url) {
   const { file, args } = browserOpener(url);
   return new Promise((resolve10) => {
+    let settled = false;
+    const finish = (opened) => {
+      if (settled) return;
+      settled = true;
+      resolve10(opened);
+    };
     const child = spawn(file, args, { detached: true, stdio: "ignore" });
-    child.on("error", () => resolve10(false));
+    child.on("error", () => finish(false));
+    child.on("exit", (code) => {
+      if (code !== null && code !== 0) finish(false);
+    });
     child.unref();
-    setTimeout(() => resolve10(true), 300).unref();
+    setTimeout(() => finish(true), 300).unref();
   });
 }
 function browserOpener(url) {
@@ -4674,7 +4760,7 @@ function browserOpener(url) {
   if (process.platform === "win32") return { file: "cmd", args: ["/c", "start", "", url] };
   return { file: "xdg-open", args: [url] };
 }
-var IDLE_TIMEOUT_MS, APPLY_LINGER_MS, MAX_BODY_BYTES, MAX_CANDIDATES;
+var IDLE_TIMEOUT_MS, MAX_LIFETIME_MS, APPLY_LINGER_MS, MAX_BODY_BYTES, MAX_CANDIDATES, PREVIEW_CAP, SYSTEM_ROOTS;
 var init_setup_web = __esm({
   "src/commands/setup-web.ts"() {
     "use strict";
@@ -4686,9 +4772,24 @@ var init_setup_web = __esm({
     init_setup();
     init_setup_web_page();
     IDLE_TIMEOUT_MS = 10 * 60 * 1e3;
+    MAX_LIFETIME_MS = 60 * 60 * 1e3;
     APPLY_LINGER_MS = 1e3;
     MAX_BODY_BYTES = 64 * 1024;
     MAX_CANDIDATES = 8;
+    PREVIEW_CAP = 5e3;
+    SYSTEM_ROOTS = [
+      "/",
+      "/usr",
+      "/bin",
+      "/sbin",
+      "/etc",
+      "/dev",
+      "/proc",
+      "/sys",
+      "/System",
+      "/Library",
+      "/opt"
+    ];
   }
 });
 
@@ -8251,7 +8352,7 @@ init_errors();
 init_config();
 init_vault();
 init_ui();
-import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve9 } from "path";
+import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve9 } from "path";
 import { Command as Command17 } from "commander";
 var VIA_MEANS = {
   flag: "because --vault named it",
@@ -8328,7 +8429,7 @@ A pointer to an unlinked folder would fail on every command instead of at this o
       });
       return;
     }
-    const value = isInside(root, where) ? relative2(where, root) || "." : root;
+    const value = isInside(root, where) ? relative3(where, root) || "." : root;
     const file = resolve9(where, BRAND.pointerFileName);
     await writeThenRename(file, `${value}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memgineering",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "private": false,
   "description": "One memory for the AI you connect. Recall, remember, and revise a brain your agents share — stored in your own folder.",
   "license": "Apache-2.0",