openclaw-smartmeter 0.5.3 → 0.5.4

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.4] - 2025-07-14
+
+### Fixed
+
+- **Multi-user key isolation (defense in depth)**: Completely prevents API key contamination between macOS users on shared machines
+  - **Session token authentication**: Each `smartmeter analyze` invocation generates a unique cryptographic token; the API server rejects requests without a matching token, making cross-user API calls impossible
+  - **CORS origin locking**: API server restricts CORS to the exact dashboard origin (e.g., `http://localhost:8081`) instead of wildcard `*`
+  - **Cache-busting headers**: All served files include `Cache-Control: no-store` to prevent stale dashboard pages from being cached
+  - **Fixed `cmdServe` missing apiPort**: The `smartmeter serve` command now correctly passes the API port to the static server (was defaulting to 3001)
+  - All API calls from the dashboard now go through an authenticated `apiFetch()` wrapper that attaches the session token header
+
 ## [0.3.0] - 2026-02-11
 
 ### Added

package/canvas-template/app.js

@@ -6,6 +6,21 @@
 /* ─── Globals ─── */
 const API_BASE_URL = `http://localhost:${window.__SMARTMETER_API_PORT || 3001}`;
 const STORAGE_PREFIX = window.__SMARTMETER_USER ? `smartmeter_${window.__SMARTMETER_USER}_` : 'smartmeter_';
+const SESSION_TOKEN = window.__SMARTMETER_TOKEN || '';
+
+/**
+ * Authenticated fetch wrapper — attaches the session token so the API server
+ * can verify that this dashboard belongs to the same SmartMeter session.
+ * Prevents cross-user contamination on shared machines.
+ */
+function apiFetch(url, opts = {}) {
+  const headers = { ...(opts.headers || {}) };
+  if (SESSION_TOKEN) {
+    headers['X-SmartMeter-Token'] = SESSION_TOKEN;
+  }
+  return fetch(url, { ...opts, headers });
+}
+
 let analysisData = null;
 let modelChart = null;
 let taskChart = null;
@@ -38,7 +53,7 @@ async function initializeDashboard() {
 async function loadAnalysisData() {
   try {
     // First try the API
-    const res = await fetch(`${API_BASE_URL}/api/status`, { signal: AbortSignal.timeout(3000) });
+    const res = await apiFetch(`${API_BASE_URL}/api/status`, { signal: AbortSignal.timeout(3000) });
     if (res.ok) {
       const json = await res.json();
       if (json.success && json.analysis) {
@@ -654,7 +669,7 @@ function resetBudgetDefaults() {
 
 async function applyBudgetControls() {
   try {
-    const res = await fetch(`${API_BASE_URL}/api/apply`, {
+    const res = await apiFetch(`${API_BASE_URL}/api/apply`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({
@@ -772,7 +787,7 @@ async function applySelectedRecommendations() {
   if (!confirmed) return;
 
   try {
-    const res = await fetch(`${API_BASE_URL}/api/apply`, {
+    const res = await apiFetch(`${API_BASE_URL}/api/apply`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ confirm: true })
@@ -857,7 +872,7 @@ async function validateInlineApiKey() {
 
   // Try API server first
   try {
-    const res = await fetch(`${API_BASE_URL}/api/config/openrouter-key`, {
+    const res = await apiFetch(`${API_BASE_URL}/api/config/openrouter-key`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ apiKey: key })
@@ -867,7 +882,7 @@ async function validateInlineApiKey() {
       validated = true;
       // Fetch usage via API server
       try {
-        const ur = await fetch(`${API_BASE_URL}/api/openrouter-usage`);
+        const ur = await apiFetch(`${API_BASE_URL}/api/openrouter-usage`);
         const uj = await ur.json();
         if (uj.success && uj.configured) usageData = uj.data || uj;
       } catch {}
@@ -970,7 +985,7 @@ async function initGetStartedCard() {
   // Try to fetch balance
   let usageData = null;
   try {
-    const res = await fetch(`${API_BASE_URL}/api/openrouter-usage`);
+    const res = await apiFetch(`${API_BASE_URL}/api/openrouter-usage`);
     const json = await res.json();
     if (json.success && json.configured) {
       usageData = json.data || json;
@@ -1191,7 +1206,7 @@ async function confirmApplyRecommendations() {
   if (btn) { btn.disabled = true; btn.textContent = 'Applying…'; }
 
   try {
-    const res = await fetch(`${API_BASE_URL}/api/apply`, {
+    const res = await apiFetch(`${API_BASE_URL}/api/apply`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ confirm: true })
@@ -1218,7 +1233,7 @@ async function confirmApplyRecommendations() {
 /* ─── OpenRouter Integration ─── */
 async function checkOpenRouterConfig() {
   try {
-    const res = await fetch(`${API_BASE_URL}/api/config/openrouter-key`);
+    const res = await apiFetch(`${API_BASE_URL}/api/config/openrouter-key`);
     if (!res.ok) return;
     const json = await res.json();
     if (json.configured) {
@@ -1232,7 +1247,7 @@ async function checkOpenRouterConfig() {
 async function fetchOpenRouterUsage() {
   const container = document.getElementById('openRouterContent');
   try {
-    const res = await fetch(`${API_BASE_URL}/api/openrouter-usage`);
+    const res = await apiFetch(`${API_BASE_URL}/api/openrouter-usage`);
     if (!res.ok) return;
     const json = await res.json();
     if (json.success && json.configured) {
@@ -1313,7 +1328,7 @@ async function saveApiKey() {
 
   // Try API server first
   try {
-    const res = await fetch(`${API_BASE_URL}/api/config/openrouter-key`, {
+    const res = await apiFetch(`${API_BASE_URL}/api/config/openrouter-key`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ apiKey: key })
@@ -1361,7 +1376,7 @@ async function saveApiKey() {
 /* ─── Preview Modal ─── */
 async function viewConfig() {
   try {
-    const res = await fetch(`${API_BASE_URL}/api/preview`);
+    const res = await apiFetch(`${API_BASE_URL}/api/preview`);
     const json = await res.json();
     if (json.success) {
       document.getElementById('previewConfigCode').textContent = JSON.stringify(json.config, null, 2);
@@ -1381,7 +1396,7 @@ async function applyOptimizations() {
   const confirmed = confirm('Apply all optimizations? A backup will be created.');
   if (!confirmed) return;
   try {
-    const res = await fetch(`${API_BASE_URL}/api/apply`, {
+    const res = await apiFetch(`${API_BASE_URL}/api/apply`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ confirm: true })
@@ -1401,7 +1416,7 @@ async function applyOptimizations() {
 /* ─── Export ─── */
 async function exportReport() {
   try {
-    const res = await fetch(`${API_BASE_URL}/api/export`);
+    const res = await apiFetch(`${API_BASE_URL}/api/export`);
     if (!res.ok) throw new Error('Export failed');
     const blob = await res.blob();
     const url = URL.createObjectURL(blob);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-smartmeter",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "AI cost optimization for OpenClaw - analyze usage and reduce costs by 48%",
   "main": "src/cli/index.js",
   "bin": {
@@ -54,4 +54,4 @@
     "fs-extra": "^11.2.0",
     "open": "^9.1.0"
   }
-}
+}

package/src/canvas/api-server.js

@@ -61,6 +61,8 @@ export class ApiServer {
     this.port = opts.port || 3001;
     this.canvasDir = opts.canvasDir;
     this.server = null;
+    this.sessionToken = opts.sessionToken || '';
+    this.dashboardOrigin = opts.dashboardOrigin || null;
   }
 
   /**
@@ -68,13 +70,14 @@ export class ApiServer {
    */
   async start() {
     this.server = createServer(async (req, res) => {
-      // Enable CORS for local development
-      res.setHeader("Access-Control-Allow-Origin", "*");
+      // CORS — restrict to the specific dashboard origin when available
+      const allowedOrigin = this.dashboardOrigin || '*';
+      res.setHeader("Access-Control-Allow-Origin", allowedOrigin);
       res.setHeader(
         "Access-Control-Allow-Methods",
         "GET, POST, PUT, DELETE, OPTIONS",
       );
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type, X-SmartMeter-Token");
 
       if (req.method === "OPTIONS") {
         res.writeHead(200);
@@ -82,6 +85,16 @@ export class ApiServer {
         return;
       }
 
+      // Session-token authentication: reject requests from other users' dashboards
+      if (this.sessionToken) {
+        const reqToken = req.headers['x-smartmeter-token'] || '';
+        if (reqToken !== this.sessionToken) {
+          res.writeHead(403, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ success: false, error: 'Invalid session — this API server belongs to a different SmartMeter session.' }));
+          return;
+        }
+      }
+
       try {
         await this.handleRequest(req, res);
       } catch (error) {

package/src/cli/commands.js

@@ -1,6 +1,7 @@
 import { readFile, writeFile, readdir, copyFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { randomBytes } from "node:crypto";
 
 import { parseAllSessions } from "../analyzer/parser.js";
 import { classifyTasks } from "../analyzer/classifier.js";
@@ -87,16 +88,24 @@ export async function cmdAnalyze(opts = {}) {
       const port = opts.port || 8080;
       const apiPort = opts.apiPort || 3001;
       
+      // Generate a unique session token for this invocation.
+      // The API server rejects requests without a matching token,
+      // preventing cross-user contamination on shared machines.
+      const sessionToken = randomBytes(16).toString('hex');
+      
       // Start API server in background
       console.log("✓ Starting API server...");
-      const apiServer = await startApiServer({ port: apiPort });
+      const apiServer = await startApiServer({ port: apiPort, sessionToken });
       const actualApiPort = apiServer.server.address().port;
       
-      // Start static file server in background (pass API port for injection)
+      // Start static file server in background (pass API port + token for injection)
       console.log("✓ Starting dashboard server...");
-      const staticServer = await startStaticFileServer(deployer.canvasDir, port, { apiPort: actualApiPort });
+      const staticServer = await startStaticFileServer(deployer.canvasDir, port, { apiPort: actualApiPort, sessionToken });
       const actualPort = staticServer.port;
       
+      // Now that we know both ports, update the API server's CORS allowedOrigin
+      apiServer.dashboardOrigin = `http://localhost:${actualPort}`;
+      
       const url = `http://localhost:${actualPort}`;
       
       console.log(`
@@ -788,16 +797,22 @@ export async function cmdServe(opts = {}) {
   }
 
   try {
+    // Generate session token for cross-server authentication
+    const sessionToken = randomBytes(16).toString('hex');
+
     // Start API server
     console.log("\n🚀 Starting API server...");
-    const apiServer = await startApiServer({ port: apiPort });
+    const apiServer = await startApiServer({ port: apiPort, sessionToken });
     const actualApiPort = apiServer.server.address().port;
 
     // Start static file server (using Node.js)
     console.log(`\n🚀 Starting dashboard server on port ${port}...`);
-    const staticServer = await startStaticFileServer(deployer.canvasDir, port);
+    const staticServer = await startStaticFileServer(deployer.canvasDir, port, { apiPort: actualApiPort, sessionToken });
     const actualPort = staticServer.port;
 
+    // Lock CORS to the actual dashboard origin
+    apiServer.dashboardOrigin = `http://localhost:${actualPort}`;
+
     const url = `http://localhost:${actualPort}`;
     console.log(`
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
@@ -892,8 +907,16 @@ async function startStaticFileServer(directory, port, options = {}) {
   const { userInfo } = await import("node:os");
 
   const apiPort = options.apiPort || 3001;
+  const sessionToken = options.sessionToken || '';
   const osUser = (() => { try { return userInfo().username; } catch { return ''; } })();
-  const portScript = `<script>window.__SMARTMETER_API_PORT=${apiPort};window.__SMARTMETER_USER=${JSON.stringify(osUser)};</script>`;
+  const injectedScript = `<script>window.__SMARTMETER_API_PORT=${apiPort};window.__SMARTMETER_USER=${JSON.stringify(osUser)};window.__SMARTMETER_TOKEN=${JSON.stringify(sessionToken)};</script>`;
+
+  // Cache-busting: force no-cache on all responses to prevent stale dashboards
+  const noCacheHeaders = {
+    'Cache-Control': 'no-store, no-cache, must-revalidate, max-age=0',
+    'Pragma': 'no-cache',
+    'Expires': '0',
+  };
 
   const mimeTypes = {
     '.html': 'text/html',
@@ -911,6 +934,8 @@ async function startStaticFileServer(directory, port, options = {}) {
     try {
       // Parse URL and handle root
       let filePath = req.url === '/' ? '/index.html' : req.url;
+      // Strip query strings (cache busters, etc.)
+      filePath = filePath.split('?')[0];
       filePath = join(directory, filePath);
 
       // Check if file exists
@@ -925,17 +950,17 @@ async function startStaticFileServer(directory, port, options = {}) {
       const ext = extname(filePath);
       const mimeType = mimeTypes[ext] || 'application/octet-stream';
 
-      // Inject API port and OS username into index.html so dashboard connects
-      // to the correct API server and scopes localStorage per user
+      // Inject API port, session token, and OS username into index.html so
+      // dashboard connects to the correct API server and can't cross-contaminate
       if (ext === '.html') {
         let html = content.toString('utf-8');
-        html = html.replace('</head>', `${portScript}\n</head>`);
-        res.writeHead(200, { 'Content-Type': mimeType });
+        html = html.replace('</head>', `${injectedScript}\n</head>`);
+        res.writeHead(200, { 'Content-Type': mimeType, ...noCacheHeaders });
         res.end(html);
         return;
       }
 
-      res.writeHead(200, { 'Content-Type': mimeType });
+      res.writeHead(200, { 'Content-Type': mimeType, ...noCacheHeaders });
       res.end(content);
     } catch (error) {
       res.writeHead(404, { 'Content-Type': 'text/plain' });