shadow-claw 1.24.0 → 1.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shadow-claw",
-  "version": "1.24.0",
+  "version": "1.25.0",
   "type": "module",
   "license": "AGPL-3.0",
   "description": "Browser-native personal AI assistant.",

package/src/components/settings/shadow-claw-notifications/shadow-claw-notifications.test.ts

@@ -11,6 +11,9 @@ jest.unstable_mockModule(
     getPushUrl: jest
       .fn<any>()
       .mockImplementation((path: string) => Promise.resolve(path)),
+    getPushFetchOptions: jest
+      .fn<any>()
+      .mockImplementation((_url: string, opts?: any) => opts || {}),
   }),
 );
 

package/src/components/settings/shadow-claw-notifications/shadow-claw-notifications.ts

@@ -1,5 +1,6 @@
 import {
   getCurrentSubscription,
+  getPushFetchOptions,
   getPushUrl,
   subscribeToPush,
   unsubscribeFromPush,
@@ -186,9 +187,12 @@ export class ShadowClawNotifications extends ShadowClawElement {
 
     try {
       const url = await getPushUrl(`/push/subscription/${this._selectedId}`);
-      const res = await fetch(url, {
-        method: "DELETE",
-      });
+      const res = await fetch(
+        url,
+        getPushFetchOptions(url, {
+          method: "DELETE",
+        }),
+      );
 
       if (res.ok) {
         showSuccess("Subscription deleted.");
@@ -237,11 +241,14 @@ export class ShadowClawNotifications extends ShadowClawElement {
 
     try {
       const url = await getPushUrl("/push/send");
-      const res = await fetch(url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ endpoint: sub.endpoint, payload }),
-      });
+      const res = await fetch(
+        url,
+        getPushFetchOptions(url, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ endpoint: sub.endpoint, payload }),
+        }),
+      );
 
       if (res.ok) {
         showSuccess("Notification sent!");
@@ -303,10 +310,37 @@ export class ShadowClawNotifications extends ShadowClawElement {
     }
 
     try {
+      const isStaticHost =
+        typeof location !== "undefined" &&
+        (location.protocol === "file:" ||
+          location.hostname.endsWith(".github.io") ||
+          location.hostname.endsWith(".pages.dev"));
+
+      const db = await getDb();
+      const proxyUrl =
+        (await getConfig(db, CONFIG_KEYS.PUSH_PROXY_URL)) ||
+        (typeof localStorage !== "undefined"
+          ? localStorage.getItem(CONFIG_KEYS.PUSH_PROXY_URL)
+          : null);
+
+      if (isStaticHost && !proxyUrl) {
+        this._subscriptions = [];
+        this._backendAvailable = false;
+        this._selectedId = null;
+        this.renderSubscriptionList();
+        this.updateActionButtons();
+        return;
+      }
+
       const url = await getPushUrl("/push/subscriptions");
-      const res = await fetch(url);
+      const res = await fetch(url, getPushFetchOptions(url));
 
       if (!res.ok) {
+        this._subscriptions = [];
+        this._backendAvailable = false;
+        this._selectedId = null;
+        this.renderSubscriptionList();
+        this.updateActionButtons();
         return;
       }
 

package/src/core/backup-controller.ts

@@ -29,6 +29,25 @@ export interface BackupInitiateResult {
   totalBytes: number;
 }
 
+function getTargetAddressSpace(urlStr: string): string | undefined {
+  try {
+    const u = new URL(urlStr);
+    const host = u.hostname.toLowerCase();
+    if (
+      host === "localhost" ||
+      host === "127.0.0.1" ||
+      host === "::1" ||
+      host === "[::1]"
+    ) {
+      return "loopback";
+    }
+    if (/^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(host)) {
+      return "private";
+    }
+  } catch {}
+  return undefined;
+}
+
 export class BackupController {
   private _clientId: string;
   private _token?: string;
@@ -80,7 +99,7 @@ export class BackupController {
       }
 
       const uploadUrl = `${this._serverBaseUrl}/api/backup/upload`;
-      const res = await fetch(uploadUrl, {
+      const uploadOpts: any = {
         method: "POST",
         headers,
         body: JSON.stringify({
@@ -90,7 +109,12 @@ export class BackupController {
           content: contentStr,
           encoding,
         }),
-      });
+      };
+      const uploadAddressSpace = getTargetAddressSpace(uploadUrl);
+      if (uploadAddressSpace) {
+        uploadOpts.targetAddressSpace = uploadAddressSpace;
+      }
+      const res = await fetch(uploadUrl, uploadOpts);
 
       if (!res.ok) {
         const errorText = await res.text().catch(() => res.statusText);
@@ -109,7 +133,7 @@ export class BackupController {
 
     // Finalize backup
     const completeUrl = `${this._serverBaseUrl}/api/backup/complete`;
-    const completeRes = await fetch(completeUrl, {
+    const completeOpts: any = {
       method: "POST",
       headers,
       body: JSON.stringify({
@@ -118,7 +142,12 @@ export class BackupController {
         fileCount: uploadedCount,
         totalBytes,
       }),
-    });
+    };
+    const completeAddressSpace = getTargetAddressSpace(completeUrl);
+    if (completeAddressSpace) {
+      completeOpts.targetAddressSpace = completeAddressSpace;
+    }
+    const completeRes = await fetch(completeUrl, completeOpts);
 
     if (!completeRes.ok) {
       const errorText = await completeRes

package/src/core/control-plane-client.test.ts

@@ -97,7 +97,12 @@ class MockEventSource {
 
 describe("control-plane-client", () => {
   let mockFetch: jest.Mock<any>;
-  let postedRequests: Array<{ url: string; body: any; headers: any }>;
+  let postedRequests: Array<{
+    url: string;
+    body: any;
+    headers: any;
+    targetAddressSpace?: string;
+  }>;
 
   beforeEach(() => {
     MockClientWebSocket.instances = [];
@@ -108,6 +113,7 @@ describe("control-plane-client", () => {
         url,
         body: JSON.parse(opts.body),
         headers: opts.headers,
+        targetAddressSpace: opts.targetAddressSpace,
       });
       return { ok: true, json: async () => ({ status: "received" }) };
     }) as any;
@@ -119,7 +125,7 @@ describe("control-plane-client", () => {
   });
 
   describe("SSE Transport (Default)", () => {
-    it("connects via EventSource and sends registration over HTTP POST", async () => {
+    it("connects via EventSource and sends registration over HTTP POST with targetAddressSpace", async () => {
       const client = new ControlPlaneClient({
         clientId: "sse-client-1",
         deviceLabel: "SSE Device",
@@ -145,6 +151,7 @@ describe("control-plane-client", () => {
       expect(postedRequests[0].body.type).toBe("client:register");
       expect(postedRequests[0].body.payload.clientId).toBe("sse-client-1");
       expect(postedRequests[0].body.payload.transport).toBe("sse");
+      expect(postedRequests[0].targetAddressSpace).toBe("loopback");
 
       client.disconnect();
       expect(client.getState()).toBe("disconnected");

package/src/core/control-plane-client.ts

@@ -353,11 +353,27 @@ export class ControlPlaneClient {
       headers["Authorization"] = `Bearer ${this._token}`;
     }
 
-    this._fetchFn(messagesUrl.toString(), {
+    const fetchOptions: any = {
       method: "POST",
       headers,
       body: JSON.stringify(msg),
-    }).catch((err) => {
+    };
+
+    const host = messagesUrl.hostname.toLowerCase();
+    const isLoopback =
+      host === "localhost" ||
+      host === "127.0.0.1" ||
+      host === "::1" ||
+      host === "[::1]";
+    const isPrivate = /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(host);
+
+    if (isLoopback) {
+      fetchOptions.targetAddressSpace = "loopback";
+    } else if (isPrivate) {
+      fetchOptions.targetAddressSpace = "private";
+    }
+
+    this._fetchFn(messagesUrl.toString(), fetchOptions).catch((err) => {
       console.warn(
         "[ControlPlaneClient] Failed to send message via HTTP POST:",
         err,

package/src/core/orchestrator/utils/operations/task.ts

@@ -4,6 +4,32 @@ import { showToast } from "../../../../ui/toast.js";
 import type { Task } from "../../../../db/types.js";
 import type { OrchestratorState } from "../../orchestrator-state.js";
 
+function getTaskFetchOptions(
+  url: string,
+  baseOptions: RequestInit = {},
+): RequestInit {
+  const opts: any = { ...baseOptions };
+  try {
+    const locOrigin =
+      typeof location !== "undefined"
+        ? location.origin
+        : "http://127.0.0.1:8888";
+    const u = new URL(url, locOrigin);
+    const host = u.hostname.toLowerCase();
+    if (
+      host === "localhost" ||
+      host === "127.0.0.1" ||
+      host === "::1" ||
+      host === "[::1]"
+    ) {
+      opts.targetAddressSpace = "loopback";
+    } else if (/^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(host)) {
+      opts.targetAddressSpace = "private";
+    }
+  } catch (_) {}
+  return opts;
+}
+
 export async function syncTaskToServer(
   state: Pick<OrchestratorState, "taskServerUrl" | "taskServerEnabled">,
   task: Task,
@@ -20,18 +46,22 @@ export async function syncTaskToServer(
   }
   try {
     const base = state.taskServerUrl.replace(/\/$/, "");
-    const res = await fetch(`${base}/tasks`, {
-      body: JSON.stringify(
-        subscriberId
-          ? {
-              ...task,
-              subscriberId,
-            }
-          : task,
-      ),
-      headers: { "Content-Type": "application/json" },
-      method: "POST",
-    });
+    const url = `${base}/tasks`;
+    const res = await fetch(
+      url,
+      getTaskFetchOptions(url, {
+        body: JSON.stringify(
+          subscriberId
+            ? {
+                ...task,
+                subscriberId,
+              }
+            : task,
+        ),
+        headers: { "Content-Type": "application/json" },
+        method: "POST",
+      }),
+    );
     if (!res.ok) {
       console.error("Server rejected task sync:", res.status);
       return false;
@@ -58,11 +88,12 @@ export async function deleteTaskFromServer(
     const suffix = subscriberId
       ? `?subscriberId=${encodeURIComponent(subscriberId)}`
       : "";
+    const url = `${base}/tasks/${encodeURIComponent(id)}${suffix}`;
     const res = await fetch(
-      `${base}/tasks/${encodeURIComponent(id)}${suffix}`,
-      {
+      url,
+      getTaskFetchOptions(url, {
         method: "DELETE",
-      },
+      }),
     );
     if (!res.ok) {
       console.error("Server rejected task deletion:", res.status);

package/src/core/utils/initControlPlane.ts

@@ -334,9 +334,11 @@ export async function executeClientControlCommand(
       }
 
       const { BackupController } = await import("../backup-controller.js");
+
       const backupCtrl = new BackupController({
         clientId,
         token: args.token,
+        serverBaseUrl: getControlPlaneServerUrl().httpUrl,
         fileEnumerator: () => collectFiles(groupDir),
         fileReader: (filePath) => readFile(filePath),
       });

package/src/server/app.ts

@@ -96,6 +96,8 @@ export function createApp(config: ServerConfig): {
   registerBackupRoutes(app, {
     backupsDir: path.resolve(config.databaseDir, "..", ".cache", "backups"),
     token: config.controlToken,
+    allowedOrigins: config.allowedOrigins,
+    corsMode: config.corsMode,
   });
 
   // ---------------- CSP REPORT ROUTES ----------------

package/src/server/config.test.ts

@@ -111,4 +111,53 @@ describe("config", () => {
 
     expect(config.rootPath).toContain("public");
   });
+
+  it("defaults https to false and provides default sslDir", async () => {
+    const { parseConfig } = await import("./config.js");
+    const config = parseConfig();
+
+    expect(config.https).toBe(false);
+    expect(config.certPath).toBeUndefined();
+    expect(config.keyPath).toBeUndefined();
+    expect(config.sslDir).toContain(".cache/tls");
+  });
+
+  it("parses HTTPS options from CLI flags", async () => {
+    commanderMock.Command().opts.mockReturnValue({
+      https: true,
+      cert: "/custom/cert.pem",
+      key: "/custom/key.pem",
+      sslDir: "/custom/ssl",
+      corsAllowOrigin: [],
+    });
+
+    const { parseConfig } = await import("./config.js");
+    const config = parseConfig();
+
+    expect(config.https).toBe(true);
+    expect(config.certPath).toBe("/custom/cert.pem");
+    expect(config.keyPath).toBe("/custom/key.pem");
+    expect(config.sslDir).toBe("/custom/ssl");
+  });
+
+  it("parses HTTPS options from environment variables", async () => {
+    processMock.env.SHADOWCLAW_HTTPS = "1";
+    processMock.env.SHADOWCLAW_TLS_CERT = "/env/cert.pem";
+    processMock.env.SHADOWCLAW_TLS_KEY = "/env/key.pem";
+    processMock.env.SHADOWCLAW_SSL_DIR = "env-ssl";
+
+    const { parseConfig } = await import("./config.js");
+    const config = parseConfig();
+
+    expect(config.https).toBe(true);
+    expect(config.certPath).toBe("/env/cert.pem");
+    expect(config.keyPath).toBe("/env/key.pem");
+    expect(config.sslDir).toBe(
+      (await import("node:path")).default.resolve(
+        config.rootPath,
+        "..",
+        "env-ssl",
+      ),
+    );
+  });
 });

package/src/server/config.ts

@@ -27,6 +27,10 @@ export interface ServerConfig {
    */
   controlToken?: string;
   allowPrivateProxy: boolean;
+  https: boolean;
+  certPath?: string;
+  keyPath?: string;
+  sslDir: string;
 }
 
 export function parseConfig(): ServerConfig {
@@ -67,6 +71,13 @@ export function parseConfig(): ServerConfig {
     .option(
       "--control-token <token>",
       "Secret token for control-plane authentication",
+    )
+    .option("--https", "Enable HTTPS dev server", false)
+    .option("--cert <path>", "Path to existing TLS certificate file")
+    .option("--key <path>", "Path to existing TLS private key file")
+    .option(
+      "--ssl-dir <path>",
+      "Directory for TLS certificate generation/storage",
     );
 
   program.parse();
@@ -178,6 +189,38 @@ export function parseConfig(): ServerConfig {
     ? options.controlToken.trim()
     : envControlToken || undefined;
 
+  // HTTPS & TLS logic
+  const https =
+    Boolean(options.https) ||
+    ["1", "true", "yes"].includes(
+      (env.SHADOWCLAW_HTTPS || "").toLowerCase().trim(),
+    );
+
+  const envCert = (env.SHADOWCLAW_TLS_CERT || env.SHADOWCLAW_CERT || "").trim();
+  const certPath = options.cert
+    ? path.resolve(options.cert)
+    : envCert
+      ? path.resolve(envCert)
+      : undefined;
+
+  const envKey = (env.SHADOWCLAW_TLS_KEY || env.SHADOWCLAW_KEY || "").trim();
+  const keyPath = options.key
+    ? path.resolve(options.key)
+    : envKey
+      ? path.resolve(envKey)
+      : undefined;
+
+  const envSslDir = (
+    env.SHADOWCLAW_SSL_DIR ||
+    env.SHADOWCLAW_TLS_DIR ||
+    ""
+  ).trim();
+  const sslDir = options.sslDir
+    ? path.resolve(options.sslDir)
+    : envSslDir
+      ? path.resolve(projectRoot, envSslDir)
+      : path.resolve(databaseDir, "..", ".cache", "tls");
+
   return {
     port,
     bindHost,
@@ -189,5 +232,9 @@ export function parseConfig(): ServerConfig {
     databaseDir,
     controlToken,
     allowPrivateProxy,
+    https,
+    certPath,
+    keyPath,
+    sslDir,
   };
 }

package/src/server/control-plane.test.ts

@@ -136,6 +136,19 @@ describe("control-plane", () => {
       expect(ws.readyState).toBe(WebSocket.OPEN);
       ws.close();
     });
+
+    it("accepts GitHub Pages origin connection without token", async () => {
+      const ws = new WebSocket(`ws://127.0.0.1:${port}/ws/control`, {
+        headers: { Origin: "https://xt-ml.github.io" },
+      });
+      await new Promise<void>((resolve, reject) => {
+        ws.on("open", () => resolve());
+        ws.on("error", reject);
+      });
+
+      expect(ws.readyState).toBe(WebSocket.OPEN);
+      ws.close();
+    });
   });
 
   describe("Client registration and heartbeat", () => {
@@ -353,6 +366,29 @@ describe("control-plane", () => {
       expect(res.data.reply?.type).toBe("server:registered");
     });
 
+    it("POST /api/control/messages processes message from GitHub Pages origin without token", async () => {
+      const res = await makeHttpRequest({
+        port,
+        path: "/api/control/messages",
+        method: "POST",
+        headers: { Origin: "https://xt-ml.github.io" },
+        body: {
+          id: "http-msg-gh-1",
+          type: "client:register",
+          payload: {
+            clientId: "http-client-gh",
+            deviceLabel: "GitHub Pages Client",
+            capabilities: ["opfs"],
+            version: "1.0.0",
+          },
+        },
+      });
+
+      expect(res.status).toBe(200);
+      expect(res.data.status).toBe("received");
+      expect(res.data.reply?.type).toBe("server:registered");
+    });
+
     it("dispatches command to SSE client and resolves when client POSTs result", async () => {
       // 1. Establish SSE connection
       let sseReq: http.ClientRequest;

package/src/server/control-plane.ts

@@ -7,6 +7,7 @@
  */
 
 import http from "node:http";
+import https from "node:https";
 import { URL } from "node:url";
 import { WebSocketServer, WebSocket } from "ws";
 import type { Express, Request, Response, NextFunction } from "express";
@@ -29,11 +30,13 @@ import type {
 } from "./control-plane-types.js";
 
 export interface ControlPlaneOptions {
-  httpServer: http.Server;
+  httpServer: http.Server | https.Server;
   app?: Express;
   token?: string;
   heartbeatTimeoutMs?: number;
   verbose?: boolean;
+  allowedOrigins?: Set<string>;
+  corsMode?: "localhost" | "private" | "all";
 }
 
 export interface PendingCommand {
@@ -115,34 +118,58 @@ export function createControlPlane(options: ControlPlaneOptions): ControlPlane {
     const origin = req.headers.origin;
     const referer = req.headers.referer;
 
-    if (origin) {
+    const isTrustedUrl = (urlStr: string): boolean => {
       try {
-        const originUrl = new URL(origin);
-        if (originUrl.host === host) {
+        const parsed = new URL(urlStr);
+        if (parsed.host === host) {
           return true;
         }
+
+        const hostname = parsed.hostname.toLowerCase();
         if (
-          originUrl.hostname === "127.0.0.1" ||
-          originUrl.hostname === "localhost"
+          hostname === "127.0.0.1" ||
+          hostname === "localhost" ||
+          hostname === "::1" ||
+          hostname === "[::1]"
         ) {
           return true;
         }
-      } catch (_) {}
-    }
 
-    if (referer) {
-      try {
-        const refererUrl = new URL(referer);
-        if (refererUrl.host === host) {
+        if (
+          hostname === "github.com" ||
+          hostname.endsWith(".github.io") ||
+          hostname.endsWith(".pages.dev")
+        ) {
+          return true;
+        }
+
+        if (options.corsMode === "all") {
+          return true;
+        }
+
+        if (
+          options.allowedOrigins &&
+          options.allowedOrigins.has(parsed.origin)
+        ) {
           return true;
         }
+
         if (
-          refererUrl.hostname === "127.0.0.1" ||
-          refererUrl.hostname === "localhost"
+          options.corsMode === "private" &&
+          /^(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/.test(hostname)
         ) {
           return true;
         }
       } catch (_) {}
+      return false;
+    };
+
+    if (origin && isTrustedUrl(origin)) {
+      return true;
+    }
+
+    if (referer && isTrustedUrl(referer)) {
+      return true;
     }
 
     const secFetchSite = req.headers["sec-fetch-site"];

package/src/server/middleware/pna.test.ts

@@ -15,7 +15,7 @@ describe("pna-middleware", () => {
     next = jest.fn();
   });
 
-  it("sets Access-Control-Allow-Private-Network header if requested", () => {
+  it("sets Access-Control-Allow-Private-Network header if requested explicitly", () => {
     req.headers["access-control-request-private-network"] = "true";
     const middleware = createPnaMiddleware(logger, false);
     middleware(req, res, next);
@@ -27,7 +27,19 @@ describe("pna-middleware", () => {
     expect(next).toHaveBeenCalled();
   });
 
-  it("does not set header if not requested", () => {
+  it("sets Access-Control-Allow-Private-Network header for cross-origin requests", () => {
+    req.headers.origin = "https://xt-ml.github.io";
+    const middleware = createPnaMiddleware(logger, false);
+    middleware(req, res, next);
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      "Access-Control-Allow-Private-Network",
+      "true",
+    );
+    expect(next).toHaveBeenCalled();
+  });
+
+  it("does not set header if neither requested nor origin present", () => {
     const middleware = createPnaMiddleware(logger, false);
     middleware(req, res, next);
 
@@ -35,7 +47,7 @@ describe("pna-middleware", () => {
     expect(next).toHaveBeenCalled();
   });
 
-  it("logs if verbose is true", () => {
+  it("logs if verbose is true and header is explicitly requested", () => {
     req.headers["access-control-request-private-network"] = "true";
     const middleware = createPnaMiddleware(logger, true);
     middleware(req, res, next);

package/src/server/middleware/pna.ts

@@ -3,8 +3,12 @@ import type { Logger } from "../logger.js";
 
 export function createPnaMiddleware(logger: Logger, verbose: boolean) {
   return (req: Request, res: Response, next: NextFunction) => {
-    if (req.headers["access-control-request-private-network"] === "true") {
-      if (verbose) {
+    const isPnaExplicit =
+      req.headers["access-control-request-private-network"] === "true";
+    const hasOrigin = Boolean(req.headers.origin);
+
+    if (isPnaExplicit || hasOrigin) {
+      if (verbose && isPnaExplicit) {
         logger.log("VERBOSE", `[PNA] Allowing Private Network Access`);
       }