shadow-claw 1.24.0 → 1.24.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shadow-claw",
-  "version": "1.24.0",
+  "version": "1.24.1",
   "type": "module",
   "license": "AGPL-3.0",
   "description": "Browser-native personal AI assistant.",

package/src/components/settings/shadow-claw-notifications/shadow-claw-notifications.test.ts

@@ -11,6 +11,9 @@ jest.unstable_mockModule(
     getPushUrl: jest
       .fn<any>()
       .mockImplementation((path: string) => Promise.resolve(path)),
+    getPushFetchOptions: jest
+      .fn<any>()
+      .mockImplementation((_url: string, opts?: any) => opts || {}),
   }),
 );
 

package/src/components/settings/shadow-claw-notifications/shadow-claw-notifications.ts

@@ -1,5 +1,6 @@
 import {
   getCurrentSubscription,
+  getPushFetchOptions,
   getPushUrl,
   subscribeToPush,
   unsubscribeFromPush,
@@ -186,9 +187,12 @@ export class ShadowClawNotifications extends ShadowClawElement {
 
     try {
       const url = await getPushUrl(`/push/subscription/${this._selectedId}`);
-      const res = await fetch(url, {
-        method: "DELETE",
-      });
+      const res = await fetch(
+        url,
+        getPushFetchOptions(url, {
+          method: "DELETE",
+        }),
+      );
 
       if (res.ok) {
         showSuccess("Subscription deleted.");
@@ -237,11 +241,14 @@ export class ShadowClawNotifications extends ShadowClawElement {
 
     try {
       const url = await getPushUrl("/push/send");
-      const res = await fetch(url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ endpoint: sub.endpoint, payload }),
-      });
+      const res = await fetch(
+        url,
+        getPushFetchOptions(url, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ endpoint: sub.endpoint, payload }),
+        }),
+      );
 
       if (res.ok) {
         showSuccess("Notification sent!");
@@ -303,10 +310,37 @@ export class ShadowClawNotifications extends ShadowClawElement {
     }
 
     try {
+      const isStaticHost =
+        typeof location !== "undefined" &&
+        (location.protocol === "file:" ||
+          location.hostname.endsWith(".github.io") ||
+          location.hostname.endsWith(".pages.dev"));
+
+      const db = await getDb();
+      const proxyUrl =
+        (await getConfig(db, CONFIG_KEYS.PUSH_PROXY_URL)) ||
+        (typeof localStorage !== "undefined"
+          ? localStorage.getItem(CONFIG_KEYS.PUSH_PROXY_URL)
+          : null);
+
+      if (isStaticHost && !proxyUrl) {
+        this._subscriptions = [];
+        this._backendAvailable = false;
+        this._selectedId = null;
+        this.renderSubscriptionList();
+        this.updateActionButtons();
+        return;
+      }
+
       const url = await getPushUrl("/push/subscriptions");
-      const res = await fetch(url);
+      const res = await fetch(url, getPushFetchOptions(url));
 
       if (!res.ok) {
+        this._subscriptions = [];
+        this._backendAvailable = false;
+        this._selectedId = null;
+        this.renderSubscriptionList();
+        this.updateActionButtons();
         return;
       }
 

package/src/core/backup-controller.ts

@@ -29,6 +29,25 @@ export interface BackupInitiateResult {
   totalBytes: number;
 }
 
+function getTargetAddressSpace(urlStr: string): string | undefined {
+  try {
+    const u = new URL(urlStr);
+    const host = u.hostname.toLowerCase();
+    if (
+      host === "localhost" ||
+      host === "127.0.0.1" ||
+      host === "::1" ||
+      host === "[::1]"
+    ) {
+      return "loopback";
+    }
+    if (/^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(host)) {
+      return "private";
+    }
+  } catch {}
+  return undefined;
+}
+
 export class BackupController {
   private _clientId: string;
   private _token?: string;
@@ -80,7 +99,7 @@ export class BackupController {
       }
 
       const uploadUrl = `${this._serverBaseUrl}/api/backup/upload`;
-      const res = await fetch(uploadUrl, {
+      const uploadOpts: any = {
         method: "POST",
         headers,
         body: JSON.stringify({
@@ -90,7 +109,12 @@ export class BackupController {
           content: contentStr,
           encoding,
         }),
-      });
+      };
+      const uploadAddressSpace = getTargetAddressSpace(uploadUrl);
+      if (uploadAddressSpace) {
+        uploadOpts.targetAddressSpace = uploadAddressSpace;
+      }
+      const res = await fetch(uploadUrl, uploadOpts);
 
       if (!res.ok) {
         const errorText = await res.text().catch(() => res.statusText);
@@ -109,7 +133,7 @@ export class BackupController {
 
     // Finalize backup
     const completeUrl = `${this._serverBaseUrl}/api/backup/complete`;
-    const completeRes = await fetch(completeUrl, {
+    const completeOpts: any = {
       method: "POST",
       headers,
       body: JSON.stringify({
@@ -118,7 +142,12 @@ export class BackupController {
         fileCount: uploadedCount,
         totalBytes,
       }),
-    });
+    };
+    const completeAddressSpace = getTargetAddressSpace(completeUrl);
+    if (completeAddressSpace) {
+      completeOpts.targetAddressSpace = completeAddressSpace;
+    }
+    const completeRes = await fetch(completeUrl, completeOpts);
 
     if (!completeRes.ok) {
       const errorText = await completeRes

package/src/core/control-plane-client.test.ts

@@ -97,7 +97,12 @@ class MockEventSource {
 
 describe("control-plane-client", () => {
   let mockFetch: jest.Mock<any>;
-  let postedRequests: Array<{ url: string; body: any; headers: any }>;
+  let postedRequests: Array<{
+    url: string;
+    body: any;
+    headers: any;
+    targetAddressSpace?: string;
+  }>;
 
   beforeEach(() => {
     MockClientWebSocket.instances = [];
@@ -108,6 +113,7 @@ describe("control-plane-client", () => {
         url,
         body: JSON.parse(opts.body),
         headers: opts.headers,
+        targetAddressSpace: opts.targetAddressSpace,
       });
       return { ok: true, json: async () => ({ status: "received" }) };
     }) as any;
@@ -119,7 +125,7 @@ describe("control-plane-client", () => {
   });
 
   describe("SSE Transport (Default)", () => {
-    it("connects via EventSource and sends registration over HTTP POST", async () => {
+    it("connects via EventSource and sends registration over HTTP POST with targetAddressSpace", async () => {
       const client = new ControlPlaneClient({
         clientId: "sse-client-1",
         deviceLabel: "SSE Device",
@@ -145,6 +151,7 @@ describe("control-plane-client", () => {
       expect(postedRequests[0].body.type).toBe("client:register");
       expect(postedRequests[0].body.payload.clientId).toBe("sse-client-1");
       expect(postedRequests[0].body.payload.transport).toBe("sse");
+      expect(postedRequests[0].targetAddressSpace).toBe("loopback");
 
       client.disconnect();
       expect(client.getState()).toBe("disconnected");

package/src/core/control-plane-client.ts

@@ -353,11 +353,27 @@ export class ControlPlaneClient {
       headers["Authorization"] = `Bearer ${this._token}`;
     }
 
-    this._fetchFn(messagesUrl.toString(), {
+    const fetchOptions: any = {
       method: "POST",
       headers,
       body: JSON.stringify(msg),
-    }).catch((err) => {
+    };
+
+    const host = messagesUrl.hostname.toLowerCase();
+    const isLoopback =
+      host === "localhost" ||
+      host === "127.0.0.1" ||
+      host === "::1" ||
+      host === "[::1]";
+    const isPrivate = /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(host);
+
+    if (isLoopback) {
+      fetchOptions.targetAddressSpace = "loopback";
+    } else if (isPrivate) {
+      fetchOptions.targetAddressSpace = "private";
+    }
+
+    this._fetchFn(messagesUrl.toString(), fetchOptions).catch((err) => {
       console.warn(
         "[ControlPlaneClient] Failed to send message via HTTP POST:",
         err,

package/src/core/orchestrator/utils/operations/task.ts

@@ -4,6 +4,32 @@ import { showToast } from "../../../../ui/toast.js";
 import type { Task } from "../../../../db/types.js";
 import type { OrchestratorState } from "../../orchestrator-state.js";
 
+function getTaskFetchOptions(
+  url: string,
+  baseOptions: RequestInit = {},
+): RequestInit {
+  const opts: any = { ...baseOptions };
+  try {
+    const locOrigin =
+      typeof location !== "undefined"
+        ? location.origin
+        : "http://127.0.0.1:8888";
+    const u = new URL(url, locOrigin);
+    const host = u.hostname.toLowerCase();
+    if (
+      host === "localhost" ||
+      host === "127.0.0.1" ||
+      host === "::1" ||
+      host === "[::1]"
+    ) {
+      opts.targetAddressSpace = "loopback";
+    } else if (/^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(host)) {
+      opts.targetAddressSpace = "private";
+    }
+  } catch (_) {}
+  return opts;
+}
+
 export async function syncTaskToServer(
   state: Pick<OrchestratorState, "taskServerUrl" | "taskServerEnabled">,
   task: Task,
@@ -20,18 +46,22 @@ export async function syncTaskToServer(
   }
   try {
     const base = state.taskServerUrl.replace(/\/$/, "");
-    const res = await fetch(`${base}/tasks`, {
-      body: JSON.stringify(
-        subscriberId
-          ? {
-              ...task,
-              subscriberId,
-            }
-          : task,
-      ),
-      headers: { "Content-Type": "application/json" },
-      method: "POST",
-    });
+    const url = `${base}/tasks`;
+    const res = await fetch(
+      url,
+      getTaskFetchOptions(url, {
+        body: JSON.stringify(
+          subscriberId
+            ? {
+                ...task,
+                subscriberId,
+              }
+            : task,
+        ),
+        headers: { "Content-Type": "application/json" },
+        method: "POST",
+      }),
+    );
     if (!res.ok) {
       console.error("Server rejected task sync:", res.status);
       return false;
@@ -58,11 +88,12 @@ export async function deleteTaskFromServer(
     const suffix = subscriberId
       ? `?subscriberId=${encodeURIComponent(subscriberId)}`
       : "";
+    const url = `${base}/tasks/${encodeURIComponent(id)}${suffix}`;
     const res = await fetch(
-      `${base}/tasks/${encodeURIComponent(id)}${suffix}`,
-      {
+      url,
+      getTaskFetchOptions(url, {
         method: "DELETE",
-      },
+      }),
     );
     if (!res.ok) {
       console.error("Server rejected task deletion:", res.status);

package/src/server/app.ts

@@ -96,6 +96,8 @@ export function createApp(config: ServerConfig): {
   registerBackupRoutes(app, {
     backupsDir: path.resolve(config.databaseDir, "..", ".cache", "backups"),
     token: config.controlToken,
+    allowedOrigins: config.allowedOrigins,
+    corsMode: config.corsMode,
   });
 
   // ---------------- CSP REPORT ROUTES ----------------

package/src/server/control-plane.test.ts

@@ -136,6 +136,19 @@ describe("control-plane", () => {
       expect(ws.readyState).toBe(WebSocket.OPEN);
       ws.close();
     });
+
+    it("accepts GitHub Pages origin connection without token", async () => {
+      const ws = new WebSocket(`ws://127.0.0.1:${port}/ws/control`, {
+        headers: { Origin: "https://xt-ml.github.io" },
+      });
+      await new Promise<void>((resolve, reject) => {
+        ws.on("open", () => resolve());
+        ws.on("error", reject);
+      });
+
+      expect(ws.readyState).toBe(WebSocket.OPEN);
+      ws.close();
+    });
   });
 
   describe("Client registration and heartbeat", () => {
@@ -353,6 +366,29 @@ describe("control-plane", () => {
       expect(res.data.reply?.type).toBe("server:registered");
     });
 
+    it("POST /api/control/messages processes message from GitHub Pages origin without token", async () => {
+      const res = await makeHttpRequest({
+        port,
+        path: "/api/control/messages",
+        method: "POST",
+        headers: { Origin: "https://xt-ml.github.io" },
+        body: {
+          id: "http-msg-gh-1",
+          type: "client:register",
+          payload: {
+            clientId: "http-client-gh",
+            deviceLabel: "GitHub Pages Client",
+            capabilities: ["opfs"],
+            version: "1.0.0",
+          },
+        },
+      });
+
+      expect(res.status).toBe(200);
+      expect(res.data.status).toBe("received");
+      expect(res.data.reply?.type).toBe("server:registered");
+    });
+
     it("dispatches command to SSE client and resolves when client POSTs result", async () => {
       // 1. Establish SSE connection
       let sseReq: http.ClientRequest;

package/src/server/control-plane.ts

@@ -34,6 +34,8 @@ export interface ControlPlaneOptions {
   token?: string;
   heartbeatTimeoutMs?: number;
   verbose?: boolean;
+  allowedOrigins?: Set<string>;
+  corsMode?: "localhost" | "private" | "all";
 }
 
 export interface PendingCommand {
@@ -115,34 +117,58 @@ export function createControlPlane(options: ControlPlaneOptions): ControlPlane {
     const origin = req.headers.origin;
     const referer = req.headers.referer;
 
-    if (origin) {
+    const isTrustedUrl = (urlStr: string): boolean => {
       try {
-        const originUrl = new URL(origin);
-        if (originUrl.host === host) {
+        const parsed = new URL(urlStr);
+        if (parsed.host === host) {
           return true;
         }
+
+        const hostname = parsed.hostname.toLowerCase();
         if (
-          originUrl.hostname === "127.0.0.1" ||
-          originUrl.hostname === "localhost"
+          hostname === "127.0.0.1" ||
+          hostname === "localhost" ||
+          hostname === "::1" ||
+          hostname === "[::1]"
         ) {
           return true;
         }
-      } catch (_) {}
-    }
 
-    if (referer) {
-      try {
-        const refererUrl = new URL(referer);
-        if (refererUrl.host === host) {
+        if (
+          hostname === "github.com" ||
+          hostname.endsWith(".github.io") ||
+          hostname.endsWith(".pages.dev")
+        ) {
+          return true;
+        }
+
+        if (options.corsMode === "all") {
+          return true;
+        }
+
+        if (
+          options.allowedOrigins &&
+          options.allowedOrigins.has(parsed.origin)
+        ) {
           return true;
         }
+
         if (
-          refererUrl.hostname === "127.0.0.1" ||
-          refererUrl.hostname === "localhost"
+          options.corsMode === "private" &&
+          /^(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(hostname)
         ) {
           return true;
         }
       } catch (_) {}
+      return false;
+    };
+
+    if (origin && isTrustedUrl(origin)) {
+      return true;
+    }
+
+    if (referer && isTrustedUrl(referer)) {
+      return true;
     }
 
     const secFetchSite = req.headers["sec-fetch-site"];

package/src/server/middleware/pna.test.ts

@@ -15,7 +15,7 @@ describe("pna-middleware", () => {
     next = jest.fn();
   });
 
-  it("sets Access-Control-Allow-Private-Network header if requested", () => {
+  it("sets Access-Control-Allow-Private-Network header if requested explicitly", () => {
     req.headers["access-control-request-private-network"] = "true";
     const middleware = createPnaMiddleware(logger, false);
     middleware(req, res, next);
@@ -27,7 +27,19 @@ describe("pna-middleware", () => {
     expect(next).toHaveBeenCalled();
   });
 
-  it("does not set header if not requested", () => {
+  it("sets Access-Control-Allow-Private-Network header for cross-origin requests", () => {
+    req.headers.origin = "https://xt-ml.github.io";
+    const middleware = createPnaMiddleware(logger, false);
+    middleware(req, res, next);
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      "Access-Control-Allow-Private-Network",
+      "true",
+    );
+    expect(next).toHaveBeenCalled();
+  });
+
+  it("does not set header if neither requested nor origin present", () => {
     const middleware = createPnaMiddleware(logger, false);
     middleware(req, res, next);
 
@@ -35,7 +47,7 @@ describe("pna-middleware", () => {
     expect(next).toHaveBeenCalled();
   });
 
-  it("logs if verbose is true", () => {
+  it("logs if verbose is true and header is explicitly requested", () => {
     req.headers["access-control-request-private-network"] = "true";
     const middleware = createPnaMiddleware(logger, true);
     middleware(req, res, next);

package/src/server/middleware/pna.ts

@@ -3,8 +3,12 @@ import type { Logger } from "../logger.js";
 
 export function createPnaMiddleware(logger: Logger, verbose: boolean) {
   return (req: Request, res: Response, next: NextFunction) => {
-    if (req.headers["access-control-request-private-network"] === "true") {
-      if (verbose) {
+    const isPnaExplicit =
+      req.headers["access-control-request-private-network"] === "true";
+    const hasOrigin = Boolean(req.headers.origin);
+
+    if (isPnaExplicit || hasOrigin) {
+      if (verbose && isPnaExplicit) {
         logger.log("VERBOSE", `[PNA] Allowing Private Network Access`);
       }
 

package/src/server/routes/backup.test.ts

@@ -121,6 +121,20 @@ describe("backup routes", () => {
     expect(res.data.backups).toBeDefined();
   });
 
+  it("allows GitHub Pages origin requests without explicit token header", async () => {
+    const res = await makeHttpRequest({
+      port,
+      path: "/api/backup/list",
+      headers: {
+        host: `127.0.0.1:${port}`,
+        origin: "https://xt-ml.github.io",
+      },
+    });
+
+    expect(res.status).toBe(200);
+    expect(res.data.backups).toBeDefined();
+  });
+
   it("uploads a file and verifies on disk", async () => {
     const res = await makeHttpRequest({
       port,

package/src/server/routes/backup.ts

@@ -20,6 +20,8 @@ import {
 export interface BackupRoutesOptions {
   backupsDir: string;
   token?: string;
+  allowedOrigins?: Set<string>;
+  corsMode?: "localhost" | "private" | "all";
 }
 
 function isSafeRelativePath(relPath: string): boolean {
@@ -37,39 +39,66 @@ function isSafeRelativePath(relPath: string): boolean {
   return true;
 }
 
-function isSameOriginBrowser(req: Request): boolean {
+function isSameOriginBrowser(
+  req: Request,
+  options?: BackupRoutesOptions,
+): boolean {
   const host = req.headers.host || "127.0.0.1";
   const origin = req.headers.origin;
   const referer = req.headers.referer;
 
-  if (origin) {
+  const isTrustedUrl = (urlStr: string): boolean => {
     try {
-      const originUrl = new URL(origin);
-      if (originUrl.host === host) {
+      const parsed = new URL(urlStr);
+      if (parsed.host === host) {
         return true;
       }
+
+      const hostname = parsed.hostname.toLowerCase();
       if (
-        originUrl.hostname === "127.0.0.1" ||
-        originUrl.hostname === "localhost"
+        hostname === "127.0.0.1" ||
+        hostname === "localhost" ||
+        hostname === "::1" ||
+        hostname === "[::1]"
       ) {
         return true;
       }
-    } catch (_) {}
-  }
 
-  if (referer) {
-    try {
-      const refererUrl = new URL(referer);
-      if (refererUrl.host === host) {
+      if (
+        hostname === "github.com" ||
+        hostname.endsWith(".github.io") ||
+        hostname.endsWith(".pages.dev")
+      ) {
+        return true;
+      }
+
+      if (options?.corsMode === "all") {
+        return true;
+      }
+
+      if (
+        options?.allowedOrigins &&
+        options.allowedOrigins.has(parsed.origin)
+      ) {
         return true;
       }
+
       if (
-        refererUrl.hostname === "127.0.0.1" ||
-        refererUrl.hostname === "localhost"
+        options?.corsMode === "private" &&
+        /^(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(hostname)
       ) {
         return true;
       }
     } catch (_) {}
+    return false;
+  };
+
+  if (origin && isTrustedUrl(origin)) {
+    return true;
+  }
+
+  if (referer && isTrustedUrl(referer)) {
+    return true;
   }
 
   const secFetchSite = req.headers["sec-fetch-site"];
@@ -103,7 +132,7 @@ export function registerBackupRoutes(
 
     const isAuthValid = providedToken
       ? providedToken === token
-      : isSameOriginBrowser(req);
+      : isSameOriginBrowser(req, options);
 
     if (!isAuthValid) {
       res.status(401).json({ error: "Unauthorized: Invalid control token" });

package/src/server/server.ts

@@ -34,6 +34,8 @@ export async function startServer(
     app,
     token: config.controlToken,
     verbose: config.verbose,
+    allowedOrigins: config.allowedOrigins,
+    corsMode: config.corsMode,
   });
 
   let serverPeer: ServerPeer | null = null;