termdock 1.4.168 → 1.4.169

package/dist/server/entry.js

@@ -1,3 +1,8 @@
+import { apiAccessGate, isTrustedLocalRequest } from './utils/apiAccess.js';
+import { assertPublicSecurity, securityHeaders } from './utils/publicSecurity.js';
+import { guardWebSocketSession } from './utils/webSocketSecurity.js';
+import { readTerminalHandshakeDimensions } from './utils/terminalHandshakeDimensions.js';
+import { apiCachePolicy } from './utils/apiCachePolicy.js';
 import 'dotenv/config';
 import express from 'express';
 import { createServer as createHttpServer } from 'http';
@@ -5,7 +10,7 @@ import { createServer as createHttpsServer } from 'https';
 import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
-import zlib from 'zlib';
+import { createStaticCompressionMiddleware, setStaticCacheHeaders } from './utils/staticAssets.js';
 import { homedir } from 'os';
 import cookieParser from 'cookie-parser';
 import { fileURLToPath } from 'url';
@@ -18,9 +23,9 @@ import { createOnboardingRouter } from './routes/onboarding.js';
 import { createLocalRouter } from './routes/local.js';
 import { csrfProtection } from './utils/csrfProtection.js';
 import { pathValidator } from './utils/pathValidator.js';
-import { isUpgradeRequestAuthenticated, requireAuth } from './utils/authProtection.js';
+import { isUpgradeRequestAuthenticated, requireAuth, renewSessionMiddleware } from './utils/authProtection.js';
 import { localAccessManager } from './utils/localAccess.js';
-import { isAllowedHost, isUpgradeOriginAllowed, validateHostMiddleware, } from './utils/requestSecurity.js';
+import { isAllowedHost, isUpgradeOriginAllowed, validateHostMiddleware, validateOriginMiddleware, } from './utils/requestSecurity.js';
 import { getCookieSecurityOptions, setSecureCookieMode } from './utils/cookieSecurity.js';
 import { requestDeadlineMiddleware } from './utils/requestDeadline.js';
 import { RuntimeMonitor } from './utils/runtimeMonitor.js';
@@ -135,128 +140,19 @@ function getDiffTraceEvent(message) {
         return message;
     return message.slice(spaceIndex + 1);
 }
-// 静态资源压缩中间件（零依赖，用 Node 内置 zlib）。
-// 动机：跨城/弱网首刷（或 PWA SW 更新后）要下载未压缩的 JS/CSS bundle，
-// express.static 默认不压缩。这里对文本类资源做 br/gzip 压缩，跨城下能把
-// bundle 下载体积砍到 ~1/4，明显缩短首屏等待。
-// 设计要点：
-//  - 只压文本类扩展名；图片/字体/woff2 等已是压缩格式，跳过避免做无用功。
-//  - 编译产物在运行期不变，按 (绝对路径 + mtimeMs + 编码) 缓存压缩结果到内存，
-//    只在第一次请求时压一次，后续直接命中，不占 CPU。
-//  - 路径必须落在 dist 目录内且文件真实存在，否则交回后续中间件（含 SPA
-//    fallback），不影响 index.html 路由与 /api 等。
-const COMPRESSIBLE_EXT = new Set(['.js', '.mjs', '.css', '.html', '.json', '.svg', '.webmanifest', '.map', '.txt']);
-// 扩展名 → Content-Type。自己维护一张小表，不依赖 express.static.mime
-// （express 5 运行期不暴露该字段，访问会抛 TypeError）。
-const CONTENT_TYPE_BY_EXT = {
-    '.js': 'text/javascript; charset=utf-8',
-    '.mjs': 'text/javascript; charset=utf-8',
-    '.css': 'text/css; charset=utf-8',
-    '.html': 'text/html; charset=utf-8',
-    '.json': 'application/json; charset=utf-8',
-    '.svg': 'image/svg+xml',
-    '.webmanifest': 'application/manifest+json; charset=utf-8',
-    '.map': 'application/json; charset=utf-8',
-    '.txt': 'text/plain; charset=utf-8',
-};
-function setStaticCacheHeaders(req, res) {
-    let pathname;
-    try {
-        pathname = decodeURIComponent(new URL(req.url, 'http://localhost').pathname);
-    }
-    catch {
-        pathname = req.path || req.url || '';
-    }
-    if (pathname === '/'
-        || pathname.endsWith('/index.html')
-        || pathname === '/sw.js'
-        || pathname === '/registerSW.js'
-        || pathname === '/manifest.webmanifest') {
-        res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
-        res.setHeader('Pragma', 'no-cache');
-        res.setHeader('Expires', '0');
-        return;
-    }
-    if (pathname.startsWith('/assets/')) {
-        res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
-    }
-}
-function createStaticCompressionMiddleware(rootDir) {
-    const resolvedRoot = path.resolve(rootDir);
-    const cache = new Map();
-    return (req, res, next) => {
-        if (req.method !== 'GET' && req.method !== 'HEAD')
-            return next();
-        const acceptEncoding = String(req.headers['accept-encoding'] || '');
-        const useBr = /\bbr\b/.test(acceptEncoding);
-        const useGzip = /\bgzip\b/.test(acceptEncoding);
-        if (!useBr && !useGzip)
-            return next();
-        // 解析并防目录穿越：只服务 dist 内的文件。
-        let pathname;
-        try {
-            pathname = decodeURIComponent(new URL(req.url, 'http://localhost').pathname);
-        }
-        catch {
-            return next();
-        }
-        const ext = path.extname(pathname).toLowerCase();
-        if (!COMPRESSIBLE_EXT.has(ext))
-            return next();
-        const filePath = path.resolve(resolvedRoot, '.' + pathname);
-        if (filePath !== resolvedRoot && !filePath.startsWith(resolvedRoot + path.sep))
-            return next();
-        let stat;
-        try {
-            stat = fs.statSync(filePath);
-        }
-        catch {
-            return next();
-        }
-        if (!stat.isFile())
-            return next();
-        const encoding = useBr ? 'br' : 'gzip';
-        const cacheKey = `${filePath}|${encoding}`;
-        let entry = cache.get(cacheKey);
-        if (!entry || entry.mtimeMs !== stat.mtimeMs) {
-            let raw;
-            try {
-                raw = fs.readFileSync(filePath);
-            }
-            catch {
-                return next();
-            }
-            const body = encoding === 'br'
-                ? zlib.brotliCompressSync(raw, {
-                    params: {
-                        [zlib.constants.BROTLI_PARAM_QUALITY]: 9,
-                        [zlib.constants.BROTLI_PARAM_SIZE_HINT]: raw.length,
-                    },
-                })
-                : zlib.gzipSync(raw, { level: 7 });
-            entry = { encoding, body, mtimeMs: stat.mtimeMs };
-            cache.set(cacheKey, entry);
-        }
-        res.setHeader('Content-Encoding', encoding);
-        res.setHeader('Vary', 'Accept-Encoding');
-        const type = CONTENT_TYPE_BY_EXT[ext];
-        if (type)
-            res.setHeader('Content-Type', type);
-        setStaticCacheHeaders(req, res);
-        res.setHeader('Content-Length', entry.body.length);
-        if (req.method === 'HEAD') {
-            res.end();
-            return;
-        }
-        res.end(entry.body);
-    };
-}
 export function createApp(options = {}) {
+    assertPublicSecurity();
     const app = express();
+    app.disable('x-powered-by');
+    app.use(securityHeaders);
     app.use(validateHostMiddleware);
+    // Authenticate before allocating request bodies, including future API routes.
+    app.use(cookieParser());
+    app.use('/api', renewSessionMiddleware);
+    app.use('/api', apiAccessGate(options.localApiToken));
     // 基础中间件
+    app.use('/api/auth', express.json({ limit: '2kb' }));
     app.use(express.json({ limit: '5mb' }));
-    app.use(cookieParser());
     // Note: clientId cookie is no longer used for session persistence (sessions are global).
     // Kept for potential future use and backward compatibility.
     app.use((req, res, next) => {
@@ -284,6 +180,7 @@ export function createApp(options = {}) {
                 return req.path || req.url || '';
             }
         })();
+        const logPathname = pathname.replace(/(\/fs\/preview\/)[0-9a-f]{32}(?=\/)/gi, '$1[redacted]');
         const routeFamily = getRouteFamily(pathname);
         let logged = false;
         const log = (event) => {
@@ -295,7 +192,7 @@ export function createApp(options = {}) {
             writeJsonLog('access.log', {
                 event,
                 method: req.method,
-                path: pathname,
+                path: logPathname,
                 routeFamily,
                 statusCode: res.statusCode,
                 durationMs: Math.round(durationMs * 100) / 100,
@@ -308,7 +205,7 @@ export function createApp(options = {}) {
                     source: 'access',
                     event,
                     method: req.method,
-                    path: pathname,
+                    path: logPathname,
                     routeFamily,
                     statusCode: res.statusCode,
                     durationMs: Math.round(durationMs * 100) / 100,
@@ -327,19 +224,7 @@ export function createApp(options = {}) {
     // 全局请求兜底超时：任何 handler 挂起最多活 30s（长连接流按表豁免），
     // 到期销毁 socket 释放浏览器连接槽。必须在所有路由与静态资源之前挂载。
     app.use(requestDeadlineMiddleware());
-    app.use('/api', (req, res, next) => {
-        // JSON/API responses must never hit browser conditional caching. A 304 with
-        // an empty body breaks fetch().json() callers and looks like random IO
-        // failures in the sidebar. The KiCad preview endpoint is a binary response,
-        // so it deliberately keeps validators to avoid retransferring multi-MB GLBs.
-        const conditionalBinaryPreview = req.path === '/terminal/fs/eda-preview';
-        if (!conditionalBinaryPreview) {
-            delete req.headers['if-none-match'];
-            delete req.headers['if-modified-since'];
-            res.setHeader('Cache-Control', 'no-store');
-        }
-        next();
-    });
+    app.use('/api', apiCachePolicy);
     // 安全中间件：CSRF令牌生成（在所有路由之前）
     app.use(csrfProtection.tokenMiddleware());
     // 健康检查端点（不需要CSRF保护，也不需要登录）
@@ -368,7 +253,7 @@ export function createApp(options = {}) {
     });
     // Client-side log relay — enables collecting browser/device logs
     // on the server, critical for debugging mobile Safari / PWA issues.
-    app.post('/api/client-log', (req, res) => {
+    app.post('/api/client-log', requireAuth(), validateOriginMiddleware, (req, res) => {
         const { level, message, data } = req.body ?? {};
         if (!shouldWriteClientLog(level, message)) {
             res.json({ ok: true, suppressed: true });
@@ -423,12 +308,7 @@ export function createApp(options = {}) {
     // A locally installed Agent/plugin CLI uses the mode-0600 local API token.
     // Keep this bypass loopback-only: possession of the token must not turn the
     // LAN-facing terminal API into a bearer-token endpoint.
-    const isTrustedLocalCliRequest = (req) => {
-        if (!options.localApiToken || req.header('X-Termdock-Local-Token') !== options.localApiToken)
-            return false;
-        const address = req.socket.remoteAddress ?? '';
-        return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
-    };
+    const isTrustedLocalCliRequest = (req) => isTrustedLocalRequest(req, options.localApiToken);
     app.get('/api/diagnostics/runtime', requireAuth({ bypass: isTrustedLocalCliRequest }), async (_req, res) => {
         if (!options.runtimeMonitor) {
             res.status(503).json({ error: 'Runtime monitor is not active', code: 'RUNTIME_MONITOR_INACTIVE' });
@@ -441,7 +321,7 @@ export function createApp(options = {}) {
     // session cookie, then get redirected to a short-lived URL token so the
     // sandboxed iframe's subresource requests (which browsers refuse to send
     // cookies for) can still load images/css/js.
-    app.use('/api/terminal', requireAuth({ bypass: (req) => req.path.startsWith('/fs/preview') || isTrustedLocalCliRequest(req) }));
+    app.use('/api/terminal', requireAuth({ bypass: (req) => /^\/fs\/preview\//i.test(req.path) || isTrustedLocalCliRequest(req) }));
     app.use('/api/terminal', csrfProtection.verifyMiddleware({ bypass: isTrustedLocalCliRequest }));
     // 终端路由
     app.use('/api/terminal', terminalRoutes);
@@ -472,6 +352,14 @@ export function createApp(options = {}) {
             res.sendFile(path.join(clientPath, 'index.html'));
         });
     }
+    // Never expose parser errors, submitted passwords, or stack traces to callers.
+    app.use((error, _req, res, next) => {
+        if (res.headersSent)
+            return next(error);
+        const candidate = error?.status;
+        const status = typeof candidate === 'number' && candidate >= 400 && candidate <= 599 ? candidate : 500;
+        res.status(status).json({ error: status === 413 ? 'Request body too large' : status < 500 ? 'Invalid request' : 'Internal server error', code: 'REQUEST_ERROR' });
+    });
     return app;
 }
 function createServerForApp(app, options) {
@@ -492,9 +380,13 @@ function reloadHttpsCertificate(server, options) {
     return true;
 }
 export function startServer(options = {}) {
+    assertPublicSecurity();
     const stopLogMaintenance = startTermdockLogMaintenance();
     const port = options.port ?? Number(process.env.PORT || DEFAULT_PORT);
     const host = options.host ?? (process.env.HOST || DEFAULT_HOST);
+    if (process.env.TERMDOCK_PUBLIC_ORIGIN && !(options.httpsCertPath && options.httpsKeyPath) && !['127.0.0.1', '::1', 'localhost'].includes(host)) {
+        throw new Error('Public access requires HTTPS certificates, or a loopback-only listener behind a TLS proxy.');
+    }
     const runtimeMonitor = new RuntimeMonitor({
         stateDirectory: path.join(homedir(), '.termdock'),
         historyPath: path.join(homedir(), '.termdock', 'runtime-metrics.log'),
@@ -507,6 +399,12 @@ export function startServer(options = {}) {
         runtimeMonitor,
     });
     const { server, scheme } = createServerForApp(app, options);
+    server.headersTimeout = 10_000;
+    server.requestTimeout = 120_000;
+    server.keepAliveTimeout = 5_000;
+    server.maxHeadersCount = 64;
+    server.maxRequestsPerSocket = 1000;
+    server.maxConnections = 1024;
     server.on('connection', (socket) => runtimeMonitor.trackSocket(socket));
     server.once('close', () => runtimeMonitor.stop());
     setSecureCookieMode(scheme === 'https');
@@ -557,6 +455,7 @@ export function startServer(options = {}) {
     //  - serverNoContextTakeover：每条消息独立压缩上下文，降低长连接常驻内存。
     const wss = new WebSocketServer({
         noServer: true,
+        maxPayload: 1024 * 1024,
         perMessageDeflate: {
             threshold: 1024,
             concurrencyLimit: 10,
@@ -568,12 +467,23 @@ export function startServer(options = {}) {
     const WS_PATH_RE = /^\/api\/terminal\/([^/]+)\/ws$/;
     const CONTROL_WS_PATH = '/api/control/ws';
     server.on('upgrade', (request, socket, head) => {
+        if (wss.clients.size >= 256) {
+            socket.end('HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\n\r\n');
+            return;
+        }
         if (!isAllowedHost(request.headers.host) || !isUpgradeOriginAllowed(request.headers.origin, request.headers.host)) {
             socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
             socket.destroy();
             return;
         }
-        const url = new URL(request.url ?? '/', `${scheme}://${request.headers.host ?? 'localhost'}`);
+        let url;
+        try {
+            url = new URL(request.url ?? '/', `${scheme}://${request.headers.host ?? 'localhost'}`);
+        }
+        catch {
+            socket.destroy();
+            return;
+        }
         const pathname = url.pathname;
         // Reject the upgrade before the WebSocket handshake completes if auth
         // is enabled and the client cookie is missing/expired. We respond with
@@ -590,6 +500,7 @@ export function startServer(options = {}) {
             const clientId = crypto.randomUUID();
             wss.handleUpgrade(request, socket, head, (ws) => {
                 handleControlWebSocket(ws, clientId);
+                guardWebSocketSession(ws, cookieHeader);
             });
             return;
         }
@@ -606,7 +517,8 @@ export function startServer(options = {}) {
         const sinceParam = url.searchParams.get('since');
         const sinceSeq = sinceParam ? Math.max(0, Number.parseInt(sinceParam, 10) || 0) : 0;
         wss.handleUpgrade(request, socket, head, (ws) => {
-            handleTerminalWebSocket(ws, sessionId, clientId, { sinceSeq, pushClientId });
+            handleTerminalWebSocket(ws, sessionId, clientId, { sinceSeq, pushClientId, streamEpoch: url.searchParams.get('epoch') ?? undefined, flowControl: url.searchParams.get('flow') === '2', independentTmux: url.searchParams.get('transport') === 'tmux-client', outputActive: url.searchParams.get('active') !== '0' }, readTerminalHandshakeDimensions(url.searchParams));
+            guardWebSocketSession(ws, cookieHeader);
         });
     });
     server.listen(port, host, () => {

package/dist/server/routes/auth.js

@@ -1,5 +1,5 @@
 import express from 'express';
-import { AUTH_COOKIE, clearSessionCookie, createSession, destroySession, getClientIp, getLoginBlockMs, isAuthEnabled, isRequestAuthenticated, recordLoginFailure, recordLoginSuccess, setSessionCookie, verifyPassword, } from '../utils/authProtection.js';
+import { AUTH_COOKIE, clearSessionCookie, createSession, destroySession, getClientIp, getLoginBlockMs, isAuthEnabled, isRequestAuthenticated, recordLoginFailure, recordLoginSuccess, setSessionCookie, verifyPasswordAsync, } from '../utils/authProtection.js';
 import { validateOriginMiddleware } from '../utils/requestSecurity.js';
 const router = express.Router();
 // GET /api/auth/status — public; tells the client whether auth is enabled
@@ -12,7 +12,7 @@ router.get('/status', (req, res) => {
 });
 // POST /api/auth/login — public; verifies password, issues session cookie.
 // Rate-limited per source IP via exponential backoff.
-router.post('/login', validateOriginMiddleware, (req, res) => {
+router.post('/login', validateOriginMiddleware, async (req, res) => {
     if (!isAuthEnabled()) {
         return res.status(400).json({ error: 'Authentication is not enabled', code: 'AUTH_DISABLED' });
     }
@@ -27,12 +27,18 @@ router.post('/login', validateOriginMiddleware, (req, res) => {
         });
     }
     const password = typeof req.body?.password === 'string' ? req.body.password : '';
-    if (!verifyPassword(password)) {
+    const verified = await verifyPasswordAsync(password);
+    if (verified === null) {
+        res.setHeader('Retry-After', '60');
+        return res.status(429).json({ error: 'Login capacity exceeded. Please retry later.', code: 'RATE_LIMITED', retryAfterMs: 60_000 });
+    }
+    if (!verified) {
         recordLoginFailure(ip);
         // Same generic message regardless of cause to avoid user-enumeration.
         return res.status(401).json({ error: 'Invalid password', code: 'INVALID_PASSWORD' });
     }
     recordLoginSuccess(ip);
+    destroySession(req.cookies?.[AUTH_COOKIE]);
     const session = createSession();
     setSessionCookie(res, session.token);
     res.json({ ok: true });

package/dist/server/routes/filesystem.js

@@ -1,3 +1,4 @@
+import { AUTH_COOKIE, isSessionValid } from '../utils/authProtection.js';
 import { Router } from 'express';
 import crypto from 'crypto';
 import fs from 'fs';
@@ -5,6 +6,7 @@ import os from 'os';
 import path from 'path';
 import { execFile, spawn } from 'child_process';
 import busboy from 'busboy';
+import { validatePreview } from '../utils/previewValidation.js';
 import { pathValidator } from '../utils/pathValidator.js';
 import { isAuthEnabled, isRequestAuthenticated } from '../utils/authProtection.js';
 import { getImageDimensions, parseImageDimensions } from '../utils/imageDimensions.js';
@@ -2957,6 +2959,8 @@ router.get('/read', async (req, res) => {
             if (!stat.isFile()) {
                 throw new Error('Path is not a regular file');
             }
+            if (validatePreview(req, res, resolvedPath, stat, `text-v1-${MAX_FILE_SIZE}`))
+                return null;
             const bytesToRead = Math.min(stat.size, MAX_FILE_SIZE);
             const truncated = stat.size > bytesToRead;
             const buffer = await readBytesPrefix(resolvedPath, bytesToRead);
@@ -2967,6 +2971,10 @@ router.get('/read', async (req, res) => {
             throwIfAborted(controller.signal, 'fs.read');
             return { resolvedPath, stat, buffer, binary, truncated };
         })(), FS_ROUTE_TIMEOUT_MS, 'File preview took too long. The file may be on slow storage or currently blocked by another process.', 'FS_READ_TIMEOUT');
+        if (!result) {
+            logFsIo({ id: requestId, action, op: 'fs.read', startedAt, status: 'ok', path: requestedPath, bytes: 0, extra: { cache: 'revalidated', requestSlotId } });
+            return;
+        }
         logFsIo({ id: requestId, action, op: 'fs.read', startedAt, status: 'ok', path: result.resolvedPath, bytes: Math.min(result.stat.size, MAX_FILE_SIZE), total: result.stat.size, truncated: result.truncated, extra: { requestSlotId } });
         res.json({
             path: result.resolvedPath,
@@ -3122,6 +3130,7 @@ router.get('/eda-preview', async (req, res) => {
         res.setHeader('Cache-Control', 'private, no-cache');
         res.setHeader('X-Content-Type-Options', 'nosniff');
         res.setHeader('X-Eda-View', requestedView);
+        res.setHeader('X-Termdock-Source-Path', encodeURIComponent(resolvedPath));
         if (requestAcceptsEtag(req.headers['if-none-match'], etag)) {
             res.setHeader('X-Eda-Cache', 'revalidated');
             res.status(304).end();
@@ -3297,6 +3306,10 @@ router.get('/blob', async (req, res) => {
             }
             return { resolvedPath, stat, mimeType };
         })(), FS_ROUTE_TIMEOUT_MS, 'Image preview took too long. The file may be on slow storage or currently blocked by another process.', 'FS_BLOB_TIMEOUT');
+        if (validatePreview(req, res, resolvedPath, stat, 'image-v1')) {
+            logOnce('ok', { path: resolvedPath, bytes: 0, extra: { cache: 'revalidated' } });
+            return;
+        }
         let responseBody = null;
         let responseMimeType = mimeType;
         let responseFilename = path.basename(resolvedPath);
@@ -3315,7 +3328,7 @@ router.get('/blob', async (req, res) => {
         res.setHeader('Content-Type', responseMimeType);
         res.setHeader('Content-Length', responseSize.toString());
         res.setHeader('Last-Modified', stat.mtime.toUTCString());
-        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('Cache-Control', 'private, no-cache');
         res.setHeader('X-Content-Type-Options', 'nosniff');
         res.setHeader('Content-Disposition', buildContentDisposition('inline', responseFilename));
         // Expose dimensions so markdown image previews can reserve the final
@@ -3517,29 +3530,29 @@ export function isPathWithinPreviewRoot(root, targetPath) {
     const prefix = resolvedRoot.endsWith(path.sep) ? resolvedRoot : `${resolvedRoot}${path.sep}`;
     return resolvedTarget === resolvedRoot || resolvedTarget.startsWith(prefix);
 }
-// Sliding-expiry validation: a valid token refreshes its lifetime so a page
-// that keeps loading subresources stays usable without re-authenticating.
+// Absolute expiration and owner-session validation prevent indefinite bearer access.
 export function validatePreviewToken(token, targetPath) {
     const entry = previewTokens.get(token);
     if (!entry)
         return false;
-    if (entry.expiresAt < Date.now()) {
+    if (entry.expiresAt <= Date.now() || (entry.ownerSession ? !isSessionValid(entry.ownerSession) : isAuthEnabled())) {
         previewTokens.delete(token);
         return false;
     }
     if (!isPathWithinPreviewRoot(entry.root, targetPath))
         return false;
-    entry.expiresAt = Date.now() + PREVIEW_TOKEN_TTL_MS;
     return true;
 }
-export function mintPreviewToken(root) {
+export function mintPreviewToken(root, ownerSession) {
     const now = Date.now();
     for (const [token, entry] of previewTokens) {
         if (entry.expiresAt < now)
             previewTokens.delete(token);
     }
+    if (previewTokens.size >= 128)
+        previewTokens.delete(previewTokens.keys().next().value);
     const token = crypto.randomBytes(16).toString('hex');
-    previewTokens.set(token, { root: path.resolve(root), expiresAt: now + PREVIEW_TOKEN_TTL_MS });
+    previewTokens.set(token, { root: path.resolve(root), expiresAt: now + PREVIEW_TOKEN_TTL_MS, ownerSession });
     return token;
 }
 function tokenizePreviewUrl(previewBaseUrl, token) {
@@ -3551,7 +3564,8 @@ function tokenizePreviewUrl(previewBaseUrl, token) {
 export function injectHtmlPreviewBase(html, baseUrl) {
     if (/<base\b/i.test(html))
         return html;
-    const baseTag = `<base href="${baseUrl}">`;
+    const escapedBaseUrl = baseUrl.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    const baseTag = `<base href="${escapedBaseUrl}">`;
     const headMatch = html.match(/<head\b[^>]*>/i);
     if (headMatch && typeof headMatch.index === 'number') {
         const insertAt = headMatch.index + headMatch[0].length;
@@ -3606,7 +3620,18 @@ router.get('/preview/*path', async (req, res) => {
             res.status(401).json({ error: 'Authentication required', code: 'AUTH_REQUIRED' });
             return;
         }
+        if (maybeToken) {
+            const entry = previewTokens.get(maybeToken);
+            if (!entry || !validatePreviewToken(maybeToken, entry.root)) {
+                res.status(403).json({ error: 'Preview token invalid or expired', code: 'PREVIEW_TOKEN_INVALID' });
+                return;
+            }
+        }
         const validatedPath = await pathValidator.validatePathAsync(requestedPath);
+        if (maybeToken && !validatePreviewToken(maybeToken, validatedPath)) {
+            res.status(403).json({ error: 'Preview path outside token scope', code: 'PREVIEW_TOKEN_INVALID' });
+            return;
+        }
         let stat = await fs.promises.stat(validatedPath);
         let targetPath = validatedPath;
         let redirectUrl = null;
@@ -3633,9 +3658,13 @@ router.get('/preview/*path', async (req, res) => {
         // relative reference the document makes.
         if (authEnabled && !maybeToken) {
             const root = stat.isDirectory() ? validatedPath : path.dirname(validatedPath);
-            const tokenized = tokenizePreviewUrl(previewBaseUrl, mintPreviewToken(root));
+            const tokenized = tokenizePreviewUrl(previewBaseUrl, mintPreviewToken(root, req.cookies?.[AUTH_COOKIE]));
             redirectUrl = stat.isDirectory() && !previewBaseUrl.endsWith('/') ? `${tokenized}/` : tokenized;
         }
+        if (maybeToken && !validatePreviewToken(maybeToken, targetPath)) {
+            res.status(403).json({ error: 'Preview token invalid or expired', code: 'PREVIEW_TOKEN_INVALID' });
+            return;
+        }
         if (redirectUrl) {
             res.redirect(302, redirectUrl);
             return;
@@ -3737,6 +3766,7 @@ router.get('/download', async (req, res) => {
         res.setHeader('Cache-Control', 'no-store');
         res.setHeader('X-Content-Type-Options', 'nosniff');
         res.setHeader('Content-Disposition', buildContentDisposition('attachment', path.basename(resolvedPath)));
+        res.setHeader('X-Termdock-Source-Path', encodeURIComponent(resolvedPath));
         const stream = fs.createReadStream(resolvedPath);
         stream.on('error', (error) => {
             if (!res.headersSent) {

package/dist/server/routes/local.js

@@ -1,9 +1,10 @@
+import { isTrustedLocalRequest } from '../utils/apiAccess.js';
 import { Router } from 'express';
 import { injectBranchAudit, injectChangeAudit } from '../utils/changeAuditStore.js';
 export function createLocalRouter(options = {}) {
     const router = Router();
     router.post('/change-audit', (req, res) => {
-        if (!options.token || req.header('X-Termdock-Local-Token') !== options.token) {
+        if (!isTrustedLocalRequest(req, options.token)) {
             res.status(401).json({ error: 'Unauthorized local request' });
             return;
         }
@@ -16,7 +17,7 @@ export function createLocalRouter(options = {}) {
         res.json({ ok: true, inserted: result.inserted, total: result.total, walkthroughs: result.walkthroughs });
     });
     router.post('/branch-audit', (req, res) => {
-        if (!options.token || req.header('X-Termdock-Local-Token') !== options.token) {
+        if (!isTrustedLocalRequest(req, options.token)) {
             res.status(401).json({ error: 'Unauthorized local request' });
             return;
         }