replen 0.1.2 → 0.1.3

package/dist/index.js

@@ -34,7 +34,6 @@ async function main() {
         }
         console.log(`Signed in.`);
         console.log(`  Dashboard: ${cfg.base}`);
-        console.log(`  Token:     ${cfg.token.slice(0, 8)}…${cfg.token.slice(-4)}`);
         console.log(`  Saved:     ${cfg.savedAt}`);
         console.log(`  Config:    ${configPath()}`);
         return;

package/dist/init.js

@@ -26,6 +26,17 @@ function openBrowser(url) {
 function waitForCallback(port, expectedState) {
     return new Promise((resolve, reject) => {
         const server = createServer((req, res) => {
+            // Defence in depth against DNS rebinding: only accept requests whose
+            // Host header matches the loopback bind. Modern browsers (Chrome ≥ M94)
+            // already block public-DNS hostnames from rebinding to RFC1918, but an
+            // explicit check costs nothing.
+            const expectedHosts = new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+            const reqHost = (req.headers.host ?? "").toLowerCase();
+            if (!expectedHosts.has(reqHost)) {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("bad host");
+                return;
+            }
             const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
             if (url.pathname !== "/callback") {
                 res.writeHead(404, { "content-type": "text/plain" });

package/dist/mcp-setup.js

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, chmodSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 // Write the @replen/mcp server entry into Claude Code's config. Uses npx so
@@ -17,8 +17,16 @@ function readJson(path) {
 function writeJsonAtomic(path, data) {
     mkdirSync(dirname(path), { recursive: true });
     const tmp = `${path}.tmp.${Date.now()}`;
-    writeFileSync(tmp, JSON.stringify(data, null, 2));
+    // The file contains the user's ingest token (DIGEST_TOKEN). On a
+    // multi-user box, the default 0644 leaks it to every local user, so
+    // create the tmp file 0600 and chmod the final path after rename in
+    // case the umask changed it on this platform.
+    writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
     renameSync(tmp, path);
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch { /* best-effort on platforms that don't support chmod */ }
 }
 export async function setupMcp(token, base) {
     console.log(`  Wiring replen MCP into Claude Code config…`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Smart AI Development workflows. The AI that asks 'can we do this better?' - replen reads your codebase against the live ecosystem every morning, surfaces drop-in libraries, ideas to port, and patterns to learn from. A proactive layer for your AI coding workflow. One-command setup: opens a browser to sign in, then wires the MCP server into Claude Code / Codex.",
   "type": "module",
   "bin": {
@@ -18,7 +18,6 @@
   ],
   "keywords": [
     "replen",
-    "oss-discovery",
     "claude-code",
     "mcp",
     "cli"
@@ -30,6 +29,7 @@
     "directory": "cli"
   },
   "bugs": "https://github.com/replenhq/replen/issues",
+  "author": "replen.dev",
   "license": "MIT",
   "engines": {
     "node": ">=18"