prism-mcp-server 20.14.0 → 20.15.0

package/README.md

@@ -724,6 +724,12 @@ Every conversation feeds a persistent store. The next session loads the right co
 
 The dashboard shows your current project state, pending TODOs, intent health, and a neural knowledge graph — all built automatically from your agent sessions.
 
+It runs on loopback and is gated by a per-startup token by default — open the
+tokenized URL printed in the startup log (`http://localhost:3000/?token=…`).
+Requests with an untrusted `Host`/`Origin` are refused, closing the DNS-rebinding
+exposure fixed in GHSA-9cvx-7x8q-3g6m. See [docs/IDE_SETUP.md](docs/IDE_SETUP.md#securing-the-dashboard)
+to pin the token, disable it, or configure Basic Auth / JWKS.
+
 ### Export — read the record outside the agent
 
 `session_export_memory` writes your memory out as plain files you can read,

package/dist/dashboard/dashboardToken.js

@@ -0,0 +1,43 @@
+import { randomBytes } from "crypto";
+import { safeCompare } from "./authUtils.js";
+function isTruthy(v) {
+    const s = (v || "").trim().toLowerCase();
+    return s === "1" || s === "true" || s === "yes" || s === "on";
+}
+/**
+ * Resolve the active dashboard token, or null when token mode is off. A pinned
+ * token wins over a random one so operators can share a stable URL; an empty or
+ * whitespace-only pin is ignored (falls back to a random token).
+ */
+export function resolveDashboardToken(cfg) {
+    if (cfg.authEnabled)
+        return null; // real auth is the gate
+    if (isTruthy(cfg.optOut))
+        return null; // explicit opt-out (Host guard still applies)
+    const pinned = (cfg.pinnedToken || "").trim();
+    if (pinned)
+        return pinned;
+    return randomBytes(32).toString("hex");
+}
+/** Extract the prism_dashboard_token cookie value, if present. */
+export function tokenFromCookie(cookieHeader) {
+    // Capture the whole value (any run of non-";", non-space) so pinned tokens
+    // with hyphens/underscores match; the name is anchored to start-or-"; " so a
+    // look-alike cookie (evil_prism_dashboard_token=…) cannot match.
+    const m = (cookieHeader || "").match(/(?:^|;\s*)prism_dashboard_token=([^;\s]+)/);
+    return m ? m[1] : null;
+}
+/**
+ * True when the request presents the active token via the cookie, the
+ * X-Prism-Dashboard-Token header, or a ?token= query param. Every comparison is
+ * timing-safe and only runs against the single active token.
+ */
+export function requestHasToken(headers, queryToken, activeToken) {
+    const candidates = [tokenFromCookie(headers.cookie), headers.headerToken ?? null, queryToken];
+    return candidates.some((c) => c !== null && safeCompare(c, activeToken));
+}
+/** Build the Set-Cookie value that stores the token for a browser session. */
+export function buildTokenCookie(token, maxAgeMs, secure) {
+    return (`prism_dashboard_token=${token}; Path=/; HttpOnly; SameSite=Strict; ` +
+        `Max-Age=${Math.floor(maxAgeMs / 1000)}${secure ? "; Secure" : ""}`);
+}

package/dist/dashboard/hostGuard.js

@@ -0,0 +1,92 @@
+/**
+ * Host / Origin allow-listing for the Mind Palace dashboard.
+ *
+ * GHSA-9cvx-7x8q-3g6m: the dashboard auto-starts on every MCP boot, binds
+ * loopback, and by default runs with auth disabled. Loopback binding does NOT
+ * stop DNS rebinding — a page the developer merely visits can rebind its own
+ * hostname to 127.0.0.1 and reach this server as "same-origin", carrying an
+ * attacker-chosen Host/Origin. The server must therefore reject any request
+ * whose Host (or, when present, Origin) is not a trusted local name or the
+ * operator-configured public origin, BEFORE any route runs and independent of
+ * whether auth is configured. This mirrors the standard fix for the class
+ * (Host-header validation, cf. CVE-2025-10193).
+ *
+ * Matching by hostname only (port-agnostic) is deliberate and safe: the attack
+ * requires an attacker-controlled *name*, so `localhost` / `127.0.0.1` / `[::1]`
+ * are trustworthy on any port — which also keeps the guard correct when the
+ * server falls back to PORT+1/PORT+2 on an address-in-use conflict.
+ */
+/** Loopback host names browsers use for the local dashboard. Exact match only. */
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * Lowercased hostname (never the port) of a Host authority (`host[:port]`) or a
+ * full Origin URL. Returns null when the value cannot be parsed — a malformed or
+ * opaque value (e.g. the literal `null` Origin) is never trusted.
+ */
+function hostnameOf(value, asUrl = false) {
+    try {
+        const u = asUrl ? new URL(value) : new URL(`http://${value}`);
+        return u.hostname.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/** The set of hostnames that may be served: loopback + configured origin. */
+function trustedHostnames(cfg) {
+    const names = new Set(LOOPBACK_HOSTNAMES);
+    if (cfg.configuredOrigin) {
+        const h = hostnameOf(cfg.configuredOrigin, true);
+        if (h)
+            names.add(h);
+    }
+    return names;
+}
+/**
+ * True when a request target addresses a sensitive dashboard route — the memory
+ * API (`/api/*`) or the MCP HTTP transport (`/sse`, `/messages`) — and must
+ * therefore pass the Host/Origin gate.
+ *
+ * Scoping MUST use the same normalized pathname the router resolves, or a
+ * dot-segment target like `/x/../api/settings` slips past a raw-string prefix
+ * check while the router still collapses it to `/api/settings` and serves the
+ * data. A fixed base keeps this independent of the attacker-supplied Host; an
+ * unparseable target is treated as guarded (fail closed). Public routes (the
+ * static shell, PWA assets, the Smithery manifest) carry no session data and
+ * are intentionally out of scope.
+ */
+export function isRebindGuardedPath(requestTarget) {
+    let pathname;
+    try {
+        pathname = new URL(requestTarget || "/", "http://prism-dashboard.invalid").pathname;
+    }
+    catch {
+        return true; // unparseable target → fail closed
+    }
+    return pathname.startsWith("/api/") || pathname === "/sse" || pathname === "/messages";
+}
+/** True when the HTTP Host header names a trusted local or configured host. */
+export function isTrustedHost(hostHeader, cfg) {
+    if (!hostHeader)
+        return false; // HTTP/1.1 requires Host; absence is not trusted.
+    const name = hostnameOf(hostHeader);
+    return name !== null && trustedHostnames(cfg).has(name);
+}
+/**
+ * True when the Origin header (if the request carries one) is trusted. A request
+ * with no Origin — a top-level navigation or a non-CORS GET — is not rejected on
+ * Origin grounds; the Host check is the load-bearing gate there.
+ */
+export function isTrustedOrigin(originHeader, cfg) {
+    if (!originHeader)
+        return true; // absent Origin defers to the Host check
+    const name = hostnameOf(originHeader, true);
+    return name !== null && trustedHostnames(cfg).has(name);
+}
+/**
+ * Combined DNS-rebinding gate: the request must pass BOTH the Host and the
+ * (when present) Origin check. Call this before serving any sensitive route.
+ */
+export function isTrustedRequest(headers, cfg) {
+    return isTrustedHost(headers.host, cfg) && isTrustedOrigin(headers.origin, cfg);
+}

package/dist/dashboard/server.js

@@ -33,6 +33,8 @@ import { buildVaultDirectory } from "../utils/vaultExporter.js";
 import { redactSettings } from "../tools/commonHelpers.js";
 import { handleGraphRoutes } from "./graphRouter.js";
 import { isDashboardSettingKeyAllowed, isDashboardSettingValueAllowed } from "./settingsPolicy.js";
+import { isTrustedRequest, isRebindGuardedPath } from "./hostGuard.js";
+import { resolveDashboardToken, requestHasToken, buildTokenCookie, } from "./dashboardToken.js";
 import { safeCompare, generateToken, isAuthenticated, createRateLimiter, initJWKS, } from "./authUtils.js";
 const PORT = parseInt(process.env.PRISM_DASHBOARD_PORT || "3000", 10);
 /** Read HTTP request body as string (Buffer-based to avoid GC thrash on large imports) */
@@ -95,6 +97,16 @@ export async function startDashboardServer() {
     }
     const SESSION_TTL_MS = parseInt(process.env.PRISM_SESSION_TTL_MS ?? String(24 * 60 * 60 * 1000), 10);
     const activeSessions = new Map();
+    // ─── SECURITY: default-on dashboard token (GHSA-9cvx-7x8q-3g6m, remediation #2) ───
+    // Null when real auth is configured (that is the gate) or explicitly opted
+    // out; otherwise a random per-startup secret gates the data API as a second
+    // layer beneath the Host guard. Surfaced only in the startup log below.
+    const DASHBOARD_TOKEN = resolveDashboardToken({
+        authEnabled: AUTH_ENABLED,
+        pinnedToken: process.env.PRISM_DASHBOARD_TOKEN,
+        optOut: process.env.PRISM_DASHBOARD_NO_TOKEN,
+    });
+    const COOKIE_SECURE = !!process.env.PRISM_DASHBOARD_ORIGIN?.startsWith("https://") || !!process.env.PRISM_DASHBOARD_SECURE;
     // Auth config object — injectable for testing via authUtils.ts
     const authConfig = {
         authEnabled: AUTH_ENABLED,
@@ -199,8 +211,49 @@ return false;}
             res.writeHead(204);
             return res.end();
         }
+        // ─── SECURITY: Host / Origin allow-list (GHSA-9cvx-7x8q-3g6m) ───
+        // Reject DNS-rebinding requests before any sensitive route runs, independent
+        // of AUTH_ENABLED. A rebound browser reaches this loopback server carrying an
+        // attacker-controlled Host/Origin; only a trusted local name or the operator-
+        // configured PRISM_DASHBOARD_ORIGIN may be served the memory API / MCP
+        // transport. The public Smithery manifest (/.well-known/...) is intentionally
+        // left out of scope — it exposes no session data.
+        if (isRebindGuardedPath(req.url) &&
+            !isTrustedRequest({ host: req.headers.host, origin: req.headers.origin }, { configuredOrigin: process.env.PRISM_DASHBOARD_ORIGIN })) {
+            res.writeHead(403, { "Content-Type": "application/json" });
+            return res.end(JSON.stringify({ error: "Forbidden: untrusted Host or Origin (possible DNS rebinding)" }));
+        }
         // ─── v5.1: Auth login endpoint (always accessible) ───
         const reqUrl = new URL(req.url || "/", `http://${req.headers.host}`);
+        // ─── SECURITY: dashboard token gate (GHSA-9cvx-7x8q-3g6m, remediation #2) ───
+        // Second layer beneath the Host guard. Inert when DASHBOARD_TOKEN is null
+        // (real auth configured, or opted out). A page load carrying a valid ?token=
+        // is bootstrapped into a SameSite cookie so the SPA's later same-origin
+        // fetches authenticate transparently; the data API otherwise requires the
+        // token via cookie, X-Prism-Dashboard-Token header, or ?token= query.
+        if (DASHBOARD_TOKEN) {
+            const qToken = reqUrl.searchParams.get("token");
+            const isApiPath = reqUrl.pathname.startsWith("/api/");
+            if (!isApiPath && qToken && safeCompare(qToken, DASHBOARD_TOKEN)) {
+                reqUrl.searchParams.delete("token");
+                const cleanTarget = reqUrl.pathname + (reqUrl.search ? reqUrl.search : "");
+                res.writeHead(302, {
+                    "Set-Cookie": buildTokenCookie(DASHBOARD_TOKEN, SESSION_TTL_MS, COOKIE_SECURE),
+                    Location: cleanTarget,
+                });
+                return res.end();
+            }
+            if (isApiPath &&
+                !requestHasToken({
+                    cookie: req.headers.cookie,
+                    headerToken: req.headers["x-prism-dashboard-token"] || null,
+                }, qToken, DASHBOARD_TOKEN)) {
+                res.writeHead(401, { "Content-Type": "application/json" });
+                return res.end(JSON.stringify({
+                    error: "Dashboard token required — open the tokenized URL printed in the Prism startup log.",
+                }));
+            }
+        }
         if (AUTH_ENABLED && reqUrl.pathname === "/api/auth/login" && req.method === "POST") {
             // v6.5.1: Rate limiting — prevent brute-force attacks
             const clientIP = (req.socket?.remoteAddress || "unknown").replace(/^::ffff:/, "");
@@ -260,7 +313,8 @@ return false;}
                         version: SERVER_CONFIG.version,
                     },
                     authentication: {
-                        required: AUTH_ENABLED
+                        // True when either configured auth or the default token gate is active.
+                        required: AUTH_ENABLED || !!DASHBOARD_TOKEN
                     },
                     configSchema: {
                         type: "object",
@@ -1406,7 +1460,14 @@ self.addEventListener('message', (e) => {
     catch {
         // Non-fatal — just means the user has to know the port
     }
-    console.error(`[Prism] 🧠 Mind Palace Dashboard → http://localhost:${boundPort}`);
+    if (DASHBOARD_TOKEN) {
+        console.error(`[Prism] 🔐 Mind Palace Dashboard → http://localhost:${boundPort}/?token=${DASHBOARD_TOKEN}`);
+        console.error(`[Prism]    Data API is token-gated by default (GHSA-9cvx-7x8q-3g6m). Open the URL above once; ` +
+            `pin it with PRISM_DASHBOARD_TOKEN, or disable with PRISM_DASHBOARD_NO_TOKEN=1.`);
+    }
+    else {
+        console.error(`[Prism] 🧠 Mind Palace Dashboard → http://localhost:${boundPort}`);
+    }
     // ─── v3.1: TTL Sweep — runs at startup + every 12 hours ───────────
     // NOTE (v5.4): The Background Scheduler in server.ts now also handles
     // TTL sweeps. This dashboard sweep is kept as a legacy fallback for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.14.0",
+  "version": "20.15.0",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",