thevoidforge 21.0.13 → 21.0.15

package/dist/wizard/api/credentials.js

@@ -1,6 +1,6 @@
 import { request as httpsRequest } from 'node:https';
 import { addRoute } from '../router.js';
-import { vaultSet, vaultExists, vaultUnlock, vaultKeys, vaultPath, vaultLock } from '../lib/vault.js';
+import { vaultSet, vaultGet, vaultExists, vaultUnlock, vaultKeys, vaultPath, vaultLock } from '../lib/vault.js';
 import { parseJsonBody } from '../lib/body-parser.js';
 import { clearModelCache } from '../lib/anthropic.js';
 import { sendJson } from '../lib/http-helpers.js';
@@ -183,11 +183,16 @@ addRoute('POST', '/api/credentials/unlock', async (req, res) => {
     clearVaultFailures(ip);
     sessionPassword = body.password;
     touchVaultAccess(); // SEC-R2-004: Start auto-lock timer
-    // Check what's already stored
+    // Check what's already stored + load API key into process.env for PTY sessions
     let hasAnthropic = false;
     try {
         const keys = await vaultKeys(sessionPassword);
         hasAnthropic = keys.includes('anthropic-api-key');
+        if (hasAnthropic) {
+            const storedKey = await vaultGet(sessionPassword, 'anthropic-api-key');
+            if (storedKey)
+                process.env['ANTHROPIC_API_KEY'] = storedKey;
+        }
     }
     catch {
         // Fresh vault
@@ -220,6 +225,8 @@ addRoute('POST', '/api/credentials/anthropic', async (req, res) => {
         return;
     }
     await vaultSet(sessionPassword, 'anthropic-api-key', apiKey);
+    // Make the key available to PTY sessions spawned by this server process
+    process.env['ANTHROPIC_API_KEY'] = apiKey;
     clearModelCache();
     sendJson(res, 200, { stored: true });
 });

package/dist/wizard/lib/pty-manager.js

@@ -6,7 +6,7 @@
  * Haku moves between worlds seamlessly.
  */
 import { randomUUID } from 'node:crypto';
-import { isRemoteMode } from './tower-auth.js';
+import { isRemoteMode, isLanMode } from './tower-auth.js';
 import { audit } from './audit-log.js';
 // node-pty is a native module — dynamic import to handle missing installs gracefully
 let pty = null;
@@ -34,7 +34,9 @@ const ALLOWED_INITIAL_COMMANDS = ['claude', 'claude --dangerously-skip-permissio
 const BASE_SAFE_ENV_KEYS = ['PATH', 'HOME', 'SHELL', 'USER', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TERM_PROGRAM', 'EDITOR', 'VISUAL', 'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'NVM_DIR', 'NVM_BIN', 'NVM_INC', 'TMPDIR', 'TEMP', 'SSH_AUTH_SOCK', 'COLORTERM'];
 // FLOW-R2-007: Only pass ANTHROPIC_API_KEY in local mode
 function getSafeEnvKeys() {
-    if (isRemoteMode())
+    // Remote mode (internet-facing): exclude API key — operator's key must not leak
+    // Local + LAN mode: include API key — it's the user's own key on their network
+    if (isRemoteMode() && !isLanMode())
         return BASE_SAFE_ENV_KEYS;
     return [...BASE_SAFE_ENV_KEYS, 'ANTHROPIC_API_KEY'];
 }
@@ -69,7 +71,7 @@ export async function createSession(projectDir, projectName, label, initialComma
         }
     }
     const nodePty = await loadPty();
-    const shell = process.env['SHELL'] || '/bin/zsh';
+    const shell = process.env['SHELL'] || '/bin/bash';
     const id = randomUUID();
     // SEC-013: Build clean environment — no credential leakage into PTY
     const safeEnv = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thevoidforge",
-  "version": "21.0.13",
+  "version": "21.0.15",
   "description": "From nothing, everything. A methodology framework for building with Claude Code.",
   "type": "module",
   "engines": {