papercliped 2.5.3 → 2.5.5

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "papercliped",
-  "version": "2.5.3",
+  "version": "2.5.5",
   "description": "Run your Paperclip from Claude: control agents, sync with them and get reports, at the access level you choose.",
   "author": {
     "name": "KpnWorld"

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## v2.5.5 — security: update vulnerable dependencies
+
+- **Security:** updated dependencies with known vulnerabilities (the request-body parser, URI handling, IP parsing and query-string libraries). No action needed.
+
+## v2.5.4 — fix the website build after dependency updates
+
+- **Fixed:** the website build failed after the latest dependency updates (React and its type definitions were left on different major versions). They now match, so the site builds and deploys again. Nothing to do.
+
 ## v2.5.3 — the OpenSourcedd brand kit
 
 - **OpenSourcedd brand kit.** OpenSourcedd, the community around Papercliped, has its own mark: an open ring with the Papercliped face. papercliped.co/brand now carries its icons (rounded and circle-safe, SVG and PNG up to 1024 px), the Discord server banner, the X header and the r/OpenSourcedd banners for desktop and the Reddit app, all in light and dark, in `web/public/brand/opensourcedd/` and `web/public/brand/community/`. Everything is rebuilt by `web/scripts/community-cards.mjs`.

package/dist/accounts/connect-claim.js

@@ -0,0 +1,43 @@
+import { createHash, createHmac, randomBytes } from "node:crypto";
+/**
+ * This service-only assertion proves ownership of one EXISTING Papercliped
+ * account for a particular (already verified on Connect) OIDC identity.
+ * Disabled unless CONNECT_CLAIM_SIGNING_KEY is configured explicitly.
+ * It is NOT a login session, MCP grant, or Proxmox permission.
+ */
+export const CLAIM_TTL_SECONDS = 60;
+const ASSERTION_ISSUER = "https://papercliped.co";
+const CLAIM_AUDIENCE = "papercliped-connect";
+const ACCOUNT_ID = /^[A-Za-z0-9_-]{3,128}$/;
+/** Only the trusted Supabase Auth project may be used for Connect account claims.
+ * The OIDC issuer includes /auth/v1 (it is not an origin-only URL).
+ */
+export const CONNECT_LOGIN_ISSUER = "https://ixwbkbkdxvfmfyiyturx.supabase.co/auth/v1";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function validClaimIdentity(issuer, subject) {
+    return issuer === CONNECT_LOGIN_ISSUER && typeof subject === "string" && UUID.test(subject);
+}
+/** Bind an assertion to an exact trusted issuer + subject without including PII. */
+export function claimIdentityBinding(issuer, subject) {
+    if (!validClaimIdentity(issuer, subject))
+        throw new Error("Invalid verified identity");
+    return createHash("sha256").update(JSON.stringify([issuer, subject]), "utf8").digest("base64url");
+}
+export function signConnectClaim({ accountId, issuer, subject, signingKey, nowMs = Date.now(), }) {
+    if (!ACCOUNT_ID.test(accountId) || !validClaimIdentity(issuer, subject))
+        throw new Error("Invalid claim subject");
+    if (typeof signingKey !== "string" || Buffer.byteLength(signingKey, "utf8") < 32)
+        throw new Error("Signing key not configured");
+    if (!Number.isSafeInteger(nowMs) || nowMs < 0)
+        throw new Error("Invalid time");
+    const iat = Math.floor(nowMs / 1000);
+    const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "PCD-ACCOUNT-ASSERTION", v: 1 })).toString("base64url");
+    const payload = Buffer.from(JSON.stringify({
+        iss: ASSERTION_ISSUER, aud: CLAIM_AUDIENCE, sub: accountId,
+        jti: randomBytes(24).toString("base64url"), iat, exp: iat + CLAIM_TTL_SECONDS,
+        binding: claimIdentityBinding(issuer, subject),
+    })).toString("base64url");
+    const signed = header + "." + payload;
+    const mac = createHmac("sha256", signingKey).update(signed).digest("base64url");
+    return { assertion: signed + "." + mac, expiresIn: CLAIM_TTL_SECONDS };
+}

package/dist/http.js

@@ -75,7 +75,7 @@ async function main() {
     const web = webDir ? new WebAppRoutes({ dir: webDir, hosts, forumUrl: process.env.FORUM_URL?.trim() || null }) : undefined;
     if (web)
         console.error(`website: ${webDir}${process.env.PUBLIC_HOSTS ? ` (hosts: ${process.env.PUBLIC_HOSTS})` : ""}`);
-    const manage = provider && http.oauth?.mode === "multi" ? new ManageRoutes(provider) : undefined;
+    const manage = provider && http.oauth?.mode === "multi" ? new ManageRoutes(provider, { connectClaimSigningKey: process.env.CONNECT_CLAIM_SIGNING_KEY?.trim() || null }) : undefined;
     const server = createHttpServer(config, http, { oauth: provider, recorder, site, manage, publicApi, web });
     server.listen(http.port, http.host, () => {
         const o = http.oauth;

package/dist/manage/routes.js

@@ -1,4 +1,5 @@
 import { PolicyInputError } from "../access/policy.js";
+import { signConnectClaim, validClaimIdentity } from "../accounts/connect-claim.js";
 import { displayName } from "../accounts/alias.js";
 const HEADERS = { "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff", "Referrer-Policy": "no-referrer" };
 /** A DNS name or IPv4 literal, optionally with a port; undefined when it is anything else. */
@@ -29,8 +30,10 @@ const cleanUid = (v) => (v == null ? null : typeof v === "string" && v.length <=
  */
 export class ManageRoutes {
     p;
-    constructor(p, _o = {}) {
+    options;
+    constructor(p, options = {}) {
         this.p = p;
+        this.options = options;
     }
     json(res, status, body, extra = {}) {
         res.writeHead(status, { "Content-Type": "application/json", ...HEADERS, ...extra });
@@ -66,6 +69,34 @@ export class ManageRoutes {
         if (!path.startsWith("/api/manage"))
             return false;
         const route = path.slice("/api/manage".length) || "/";
+        // Opt-in service claim issuance for Connect. No cookies, CORS, or general
+        // login session. Existing secret-key verification supplies normal rate limits.
+        // The returned 60-second token is bound to the browser identity separately
+        // verified by Connect, and can be consumed only once there.
+        if (route === "/connect-claim") {
+            const key = this.options.connectClaimSigningKey;
+            if (!key || key.length < 32)
+                return this.json(res, 404, { error: "Not found" });
+            if (m !== "POST")
+                return this.json(res, 405, { error: "Method not allowed" }, { Allow: "POST" });
+            const b = await this.body(req);
+            if (!b || typeof b.subject !== "string" || !validClaimIdentity(b.issuer, b.subject) ||
+                typeof b.username !== "string" || b.username.length > 64 ||
+                typeof b.secret !== "string" || b.secret.length > 100) {
+                return this.json(res, 400, { error: "Invalid account claim request" });
+            }
+            const login = await this.p.manageLogin(req, b.username, b.secret);
+            if (!login.ok) {
+                return login.reason === "throttled"
+                    ? this.json(res, 429, { error: "Too many attempts" })
+                    : this.json(res, 401, { error: "Invalid credentials" });
+            }
+            const claim = signConnectClaim({
+                accountId: login.account.id, issuer: b.issuer, subject: b.subject,
+                signingKey: key, nowMs: this.options.now?.() ?? Date.now(),
+            });
+            return this.json(res, 200, claim);
+        }
         // The plugin proves the secret key once and gets its token. Throttled exactly like the sign-in page.
         if (m === "POST" && route === "/plugin-link/sign-in") {
             const b = await this.body(req);

package/docs/connect-account-claim.md

@@ -0,0 +1,20 @@
+# Connect account claim issuer (disabled by default)
+
+This bridge provides the EXISTING Papercliped account identity; Connect adds a profile in the same Supabase database.
+
+The new `POST /api/manage/connect-claim` route is **disabled unless** the server has `CONNECT_CLAIM_SIGNING_KEY` (at least 32 bytes). Use a freshly generated signing key specifically for Connect; **never reuse** `BRIDGE_SECRET`, OAuth secrets, or Paperclip credentials.
+
+The route verifies the owner's existing username + secret key via the current throttled `manageLogin` function, then returns a 60-second HMAC-SHA256 assertion with `iss=https://papercliped.co`, `aud=papercliped-connect`, canonical account `sub`, unique `jti`, and an SHA256 binding to the claimed OIDC issuer + subject. Connect must independently verify the authenticated OIDC principal, check exact binding and atomically consume the `jti` in `connect.account_assertion_replays`.
+
+**Security boundaries:** This is **not** an OIDC provider, browser session, Connect entitlement, MCP grant, or Proxmox access. The issuer does not itself verify third-party OIDC identities. Never accept the issuer/subject from an unverified browser session on the Connect side. Do not enable this route until a proper account-claiming UX, CSRF defenses, secret rotation and privacy handling are reviewed. No code is deployed from this branch.
+
+This route does not modify stored accounts or grants. It never stores or returns the user's secret key. Existing plugin sign-in and MCP OAuth behavior are unchanged.
+
+The bridge and Connect service must share the dedicated secret over their trusted server environments only. The client browser must never receive it.
+
+
+## Central Auth decision (November 5, 2026)
+
+The sole trusted login identity issuer is Supabase Auth in the **existing shared Paperclipped project**: `https://ixwbkbkdxvfmfyiyturx.supabase.co/auth/v1`. The subject is its verified `auth.users.id` UUID. Email OTP and passkeys authenticate to the *same Supabase identity*, which is mapped only after an explicit one-time claim to the existing `bridge.accounts.id`.
+
+The bridge claim contract rejects arbitrary third-party issuers and non-UUID subjects. Note that `issuer` is the entire OIDC issuer URL, including `/auth/v1`. Central `auth.papercliped.co` is the proposed sign-in UI, not the JWT issuer. The current flag stays OFF; no hosted configuration has been changed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "papercliped",
-  "version": "2.5.3",
+  "version": "2.5.5",
   "description": "Papercliped — connect Claude, ChatGPT and any MCP app to your Paperclip: control agents, sync, report. MCP server + hosted multi-tenant OAuth bridge + public stats API.",
   "license": "MIT",
   "type": "module",