noctrace 0.3.5 → 0.3.6

package/dist/server/server/ws.js

@@ -31,7 +31,22 @@ function send(ws, msg) {
  * back in real time using chokidar file watching.
  */
 export function setupWebSocket(server, claudeHome) {
-    const wss = new WebSocketServer({ server, path: '/ws', maxPayload: 64 * 1024 });
+    const wss = new WebSocketServer({
+        server,
+        path: '/ws',
+        maxPayload: 64 * 1024,
+        verifyClient: ({ origin }) => {
+            if (!origin)
+                return true; // non-browser clients (curl, wscat)
+            try {
+                const url = new URL(origin);
+                return url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+            }
+            catch {
+                return false;
+            }
+        },
+    });
     // Watch the projects directory for new .jsonl session files.
     // When a new file appears, broadcast to all connected clients so they
     // can refresh their session list without a manual page reload.
@@ -106,6 +121,11 @@ export function setupWebSocket(server, claudeHome) {
                     send(ws, { type: 'resume-error', message: 'resume requires sessionId and message' });
                     return;
                 }
+                // Cap message length to prevent abuse via cross-origin or oversized prompts
+                if (userMsg.length > 10_000) {
+                    send(ws, { type: 'resume-error', message: 'Message too long (max 10000 chars)' });
+                    return;
+                }
                 // Validate sessionId format — must be a UUID-like string, no dashes-starting args
                 if (!/^[a-zA-Z0-9_-]+$/.test(sessionId) || sessionId.startsWith('-')) {
                     send(ws, { type: 'resume-error', message: 'Invalid sessionId format' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "noctrace",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Chrome DevTools Network-tab-style waterfall visualizer for Claude Code agent workflows",
   "type": "module",
   "license": "MIT",
@@ -64,7 +64,7 @@
     "tailwindcss": "4.2.2",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "vite": "8.0.3",
+    "vite": "^8.0.5",
     "vitest": "4.1.2",
     "zustand": "5.0.12"
   }