pi-antigravity-rotator 2.3.0 → 2.3.2

package/src/exposure.ts

@@ -0,0 +1,17 @@
+import type { Config } from "./types.js";
+
+type ExposureConfig = Pick<Config, "bindHost" | "proxyPort">;
+
+export function isLoopbackBindHost(bindHost?: string | null): boolean {
+  const host = (bindHost || "0.0.0.0").trim().toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+
+export function getProxyExposureWarning(config: ExposureConfig): string | null {
+  const bindHost = config.bindHost || "0.0.0.0";
+  if (isLoopbackBindHost(bindHost)) return null;
+  return (
+    `Native and /v1 compatibility proxy routes are unauthenticated by design and are listening on ${bindHost}:${config.proxyPort}. ` +
+    "Restrict this port to localhost/LAN, a firewall, or a trusted reverse proxy, or set bindHost to 127.0.0.1 for local-only use."
+  );
+}

package/src/index.ts

@@ -24,6 +24,7 @@ import { setModelAliasesOverride } from "./types.js";
 import { writeTextFileAtomic } from "./storage.js";
 import { initDb } from "./db-store.js";
 import { stopPendingSessionReaper } from "./onboarding.js";
+import { getProxyExposureWarning } from "./exposure.js";
 
 function loadConfig(): Config {
   try {
@@ -146,6 +147,16 @@ function maybeWarnAboutAdminExposure(config: Config): void {
   console.warn();
 }
 
+function maybeWarnAboutProxyExposure(config: Config): void {
+  const warning = getProxyExposureWarning(config);
+  if (!warning) return;
+  console.warn(`WARNING: ${warning}`);
+  console.warn(
+    "WARNING: PI_ROTATOR_ADMIN_TOKEN protects dashboard/admin APIs, but not the native or /v1 proxy routes.",
+  );
+  console.warn();
+}
+
 export async function main(): Promise<void> {
   console.log("=== Pi Antigravity Rotator ===");
   console.log();
@@ -181,6 +192,7 @@ export async function main(): Promise<void> {
   maybeShowStarNudge();
   bootstrapAdminToken();
   maybeWarnAboutAdminExposure(config);
+  maybeWarnAboutProxyExposure(config);
   warnIfUsingFallbackOAuthCreds();
   warnIfInsecureTelemetryEndpoint();
   setModelSpecsOverride(config.modelSpecs ?? null);

package/src/login.ts

@@ -6,7 +6,7 @@
 
 import { createInterface } from "node:readline";
 import { addAccountToConfig, ensurePiAuthConfig, ensurePiModelsConfig, loadOrCreateAccountsConfig } from "./account-store.js";
-import { buildAuthUrl, discoverProject, exchangeAuthorizationCode, generatePkce, getOAuthClientConfig, getUserEmail } from "./oauth.js";
+import { buildAuthUrl, discoverProject, exchangeAuthorizationCode, generatePkce, generateState, getOAuthClientConfig, getUserEmail } from "./oauth.js";
 import type { AccountConfig } from "./types.js";
 import { getAccountsPath } from "./paths.js";
 
@@ -42,7 +42,8 @@ export async function runLogin(): Promise<void> {
 
 	const oauth = getOAuthClientConfig();
 	const { verifier, challenge } = generatePkce();
-	const authUrl = buildAuthUrl(verifier, challenge);
+	const state = generateState();
+	const authUrl = buildAuthUrl(state, challenge);
 
 	console.log("1. Open this URL in your browser:");
 	console.log();
@@ -66,7 +67,7 @@ export async function runLogin(): Promise<void> {
 		process.exit(1);
 	}
 
-	if (parsed.state && parsed.state !== verifier) {
+	if (parsed.state !== state) {
 		console.error("State mismatch - the URL does not match this login session.");
 		process.exit(1);
 	}

package/src/notification-poller.ts

@@ -48,6 +48,7 @@ function getVersion(): string {
 
 // ── Cached notifications ─────────────────────────────────────────────
 let _notifications: AdminNotification[] = [];
+let _initialPollTimer: ReturnType<typeof setTimeout> | null = null;
 let _pollTimer: ReturnType<typeof setInterval> | null = null;
 
 /**
@@ -100,18 +101,26 @@ export function startNotificationPoller(): void {
 	}
 
 	// Initial delayed fetch
-	setTimeout(() => {
-		void fetchNotifications();
-	}, 15_000);
+	if (!_initialPollTimer) {
+		_initialPollTimer = setTimeout(() => {
+			_initialPollTimer = null;
+			void fetchNotifications();
+		}, 15_000);
+		if (_initialPollTimer.unref) {
+			_initialPollTimer.unref();
+		}
+	}
 
 	// Periodic poll
-	_pollTimer = setInterval(() => {
-		void fetchNotifications();
-	}, POLL_INTERVAL_MS);
-
-	// Don't prevent process exit
-	if (_pollTimer.unref) {
-		_pollTimer.unref();
+	if (!_pollTimer) {
+		_pollTimer = setInterval(() => {
+			void fetchNotifications();
+		}, POLL_INTERVAL_MS);
+
+		// Don't prevent process exit
+		if (_pollTimer.unref) {
+			_pollTimer.unref();
+		}
 	}
 }
 
@@ -119,6 +128,10 @@ export function startNotificationPoller(): void {
  * Stop notification polling.
  */
 export function stopNotificationPoller(): void {
+	if (_initialPollTimer) {
+		clearTimeout(_initialPollTimer);
+		_initialPollTimer = null;
+	}
 	if (_pollTimer) {
 		clearInterval(_pollTimer);
 		_pollTimer = null;

package/src/onboarding.ts

@@ -203,6 +203,7 @@ export function startHostedLogin(
 interface CliLoginSession {
   verifier: string;
   challenge: string;
+  oauthState: string;
   authUrl: string;
   createdAt: number;
 }
@@ -221,11 +222,13 @@ function pruneCliSessions(): void {
 export function serveCliLogin(res: ServerResponse): void {
   pruneCliSessions();
   const { verifier, challenge } = generatePkce();
-  const authUrl = buildAuthUrl(verifier, challenge);
+  const oauthState = generateState();
+  const authUrl = buildAuthUrl(oauthState, challenge);
   const sessionId = generateState();
   cliLoginSessions.set(sessionId, {
     verifier,
     challenge,
+    oauthState,
     authUrl,
     createdAt: Date.now(),
   });
@@ -348,9 +351,11 @@ export async function handleCliLoginApi(
 
   // Parse the redirect URL to extract code
   let code: string | undefined;
+  let state: string | null;
   try {
     const url = new URL(redirectUrl.trim());
     code = url.searchParams.get("code") ?? undefined;
+    state = url.searchParams.get("state");
   } catch {
     res.writeHead(400, { "Content-Type": "application/json" });
     res.end(
@@ -373,6 +378,16 @@ export async function handleCliLoginApi(
     );
     return;
   }
+  if (state !== session.oauthState) {
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        ok: false,
+        error: "State mismatch - reload the login page and try again.",
+      }),
+    );
+    return;
+  }
 
   cliLoginSessions.delete(sessionId);