upfynai-code 2.5.1 → 2.6.0

package/server/middleware/auth.js

@@ -140,16 +140,24 @@ const authenticateWebSocket = async (request) => {
     } catch { /* ignore */ }
   }
 
-  if (!token) return null;
+  if (!token) {
+    console.log('[WS-Auth] No token found in cookies or query params');
+    return null;
+  }
 
   // Relay token (upfyn_ prefix) — validate against DB, not JWT
   if (token.startsWith('upfyn_') || token.startsWith('rt_')) {
+    console.log(`[WS-Auth] Relay token detected: ${token.slice(0, 12)}...`);
     try {
       const tokenData = await relayTokensDb.validateToken(token);
       if (tokenData) {
+        console.log(`[WS-Auth] Relay token VALID: userId=${tokenData.user_id} username=${tokenData.username}`);
         return { userId: Number(tokenData.user_id), username: tokenData.username };
       }
-    } catch {}
+      console.log('[WS-Auth] Relay token NOT FOUND in database');
+    } catch (err) {
+      console.error('[WS-Auth] Relay token validation error:', err.message);
+    }
     return null;
   }
 

package/server/relay-client.js

@@ -89,6 +89,21 @@ function execCommand(cmd, args, options = {}) {
   });
 }
 
+/**
+ * Resolve a binary name to its full path, checking PATH first then local node_modules/.bin
+ */
+function resolveBinary(name) {
+  const isWindows = process.platform === 'win32';
+  try {
+    const result = execSync(`${isWindows ? 'where' : 'which'} ${name}`, { stdio: 'pipe', timeout: 5000 }).toString().trim();
+    return result.split('\n')[0].trim();
+  } catch {
+    const localPath = path.join(__dirname_rc, '../node_modules/.bin', name + (isWindows ? '.cmd' : ''));
+    if (fs.existsSync(localPath)) return localPath;
+    return name; // fallback to bare name
+  }
+}
+
 /**
  * Handle incoming relay commands from the server
  */
@@ -105,7 +120,7 @@ async function handleRelayCommand(data, ws) {
         if (options?.projectPath) args.push('--cwd', options.projectPath);
         if (options?.sessionId) args.push('--continue', options.sessionId);
 
-        const proc = spawn('claude', [...args, command || ''], {
+        const proc = spawn(resolveBinary('claude'), [...args, command || ''], {
           shell: true,
           cwd: options?.projectPath || os.homedir(),
           env: process.env,
@@ -147,7 +162,7 @@ async function handleRelayCommand(data, ws) {
         }
         if (options?.model) codexArgs.push('--model', options.model);
 
-        const codexProc = spawn('codex', [...codexArgs, command || ''], {
+        const codexProc = spawn(resolveBinary('codex'), [...codexArgs, command || ''], {
           shell: true,
           cwd: options?.projectPath || options?.cwd || os.homedir(),
           env: process.env,
@@ -189,7 +204,7 @@ async function handleRelayCommand(data, ws) {
         }
         if (options?.model) cursorArgs.push('--model', options.model);
 
-        const cursorProc = spawn('cursor-agent', [...cursorArgs, command || ''], {
+        const cursorProc = spawn(resolveBinary('cursor-agent'), [...cursorArgs, command || ''], {
           shell: true,
           cwd: options?.projectPath || options?.cwd || os.homedir(),
           env: process.env,
@@ -233,12 +248,17 @@ async function handleRelayCommand(data, ws) {
 
       case 'shell-command': {
         const { command: cmd, cwd } = data;
-        // Block dangerous shell patterns
         if (!cmd || typeof cmd !== 'string') throw new Error('Invalid command');
-        const dangerous = ['rm -rf /', 'mkfs', 'dd if=', ':(){', 'fork bomb', '> /dev/sd'];
-        if (dangerous.some(d => cmd.includes(d))) throw new Error('Command blocked for safety');
+        // Block dangerous shell patterns (cross-platform)
+        const cmdLower = cmd.toLowerCase();
+        const dangerous = [
+          'rm -rf /', 'mkfs', 'dd if=', ':(){', 'fork bomb', '> /dev/sd',       // Unix
+          'format c:', 'format d:', 'format e:', 'del /s /q c:\\',               // Windows
+          'rd /s /q c:\\', 'reg delete', 'bcdedit',                              // Windows
+        ];
+        if (dangerous.some(d => cmdLower.includes(d.toLowerCase()))) throw new Error('Command blocked for safety');
         logRelayEvent('$', `Shell: ${cmd?.slice(0, 50)}`, 'dim');
-        const result = await execCommand(cmd, [], { cwd: cwd || os.homedir(), timeout: 60000 });
+        const result = await execCommand(cmd, [], { cwd: cwd || process.cwd(), timeout: 60000 });
         ws.send(JSON.stringify({ type: 'relay-response', requestId, data: { stdout: result } }));
         break;
       }
@@ -246,10 +266,11 @@ async function handleRelayCommand(data, ws) {
       case 'file-read': {
         const { filePath } = data;
         if (!filePath || typeof filePath !== 'string') throw new Error('Invalid file path');
-        // Block reading sensitive system files
         const normalizedPath = path.resolve(filePath);
-        const blocked = ['/etc/shadow', '/etc/passwd', '.ssh/id_rsa', '.env'];
-        if (blocked.some(b => normalizedPath.includes(b))) throw new Error('Access denied');
+        // Block reading sensitive files (cross-platform, case-insensitive)
+        const normLower = normalizedPath.toLowerCase().replace(/\\/g, '/');
+        const blockedRead = ['/etc/shadow', '/etc/passwd', '.ssh/id_rsa', '.ssh/id_ed25519', '/.env'];
+        if (blockedRead.some(b => normLower.includes(b))) throw new Error('Access denied');
         logRelayEvent('R', `Read: ${filePath}`, 'dim');
         const content = await fsPromises.readFile(normalizedPath, 'utf8');
         ws.send(JSON.stringify({ type: 'relay-response', requestId, data: { content } }));
@@ -259,10 +280,18 @@ async function handleRelayCommand(data, ws) {
       case 'file-write': {
         const { filePath: fp, content: fileContent } = data;
         if (!fp || typeof fp !== 'string') throw new Error('Invalid file path');
-        // Block writing to sensitive locations
         const normalizedFp = path.resolve(fp);
-        const blockedDirs = ['/etc/', '/usr/bin/', '/usr/sbin/', 'System32', '.ssh/'];
-        if (blockedDirs.some(d => normalizedFp.includes(d))) throw new Error('Access denied');
+        // Block writing to sensitive locations (cross-platform, case-insensitive)
+        const fpLower = normalizedFp.toLowerCase().replace(/\\/g, '/');
+        const blockedWrite = [
+          '/etc/', '/usr/bin/', '/usr/sbin/',                                     // Unix
+          '/windows/system32', '/windows/syswow64', '/program files',             // Windows
+          '.ssh/', '/.env',
+        ];
+        if (blockedWrite.some(d => fpLower.includes(d))) throw new Error('Access denied');
+        // Ensure parent directory exists (works across drives)
+        const parentDir = path.dirname(normalizedFp);
+        await fsPromises.mkdir(parentDir, { recursive: true }).catch(() => {});
         logRelayEvent('W', `Write: ${fp}`, 'dim');
         await fsPromises.writeFile(normalizedFp, fileContent, 'utf8');
         ws.send(JSON.stringify({ type: 'relay-response', requestId, data: { success: true } }));
@@ -271,7 +300,9 @@ async function handleRelayCommand(data, ws) {
 
       case 'file-tree': {
         const { dirPath, depth = 3 } = data;
-        const tree = await buildFileTree(dirPath || os.homedir(), depth);
+        // Use provided path (any drive), fall back to cwd, then home
+        const resolvedDir = dirPath ? path.resolve(dirPath) : process.cwd();
+        const tree = await buildFileTree(resolvedDir, depth);
         ws.send(JSON.stringify({ type: 'relay-response', requestId, data: { tree } }));
         break;
       }
@@ -279,7 +310,8 @@ async function handleRelayCommand(data, ws) {
       case 'git-operation': {
         const { gitCommand, cwd: gitCwd } = data;
         logRelayEvent('G', `Git: ${gitCommand}`, 'dim');
-        const result = await execCommand('git', [gitCommand], { cwd: gitCwd });
+        const resolvedGitCwd = gitCwd ? path.resolve(gitCwd) : process.cwd();
+        const result = await execCommand('git', [gitCommand], { cwd: resolvedGitCwd });
         ws.send(JSON.stringify({ type: 'relay-response', requestId, data: { stdout: result } }));
         break;
       }
@@ -330,6 +362,9 @@ function detectInstalledAgents() {
   const isWindows = process.platform === 'win32';
   const whichCmd = isWindows ? 'where' : 'which';
 
+  // Also check our own node_modules/.bin for bundled agents
+  const localBinDir = path.join(__dirname_rc, '../node_modules/.bin');
+
   const agents = [
     { name: 'claude', binary: 'claude', label: 'Claude Code' },
     { name: 'codex', binary: 'codex', label: 'OpenAI Codex' },
@@ -346,10 +381,20 @@ function detectInstalledAgents() {
         label: agent.label,
       };
     } catch {
-      detected[agent.name] = {
-        installed: false,
-        label: agent.label,
-      };
+      // Fallback: check bundled node_modules/.bin
+      const localPath = path.join(localBinDir, agent.binary + (isWindows ? '.cmd' : ''));
+      if (fs.existsSync(localPath)) {
+        detected[agent.name] = {
+          installed: true,
+          path: localPath,
+          label: agent.label,
+        };
+      } else {
+        detected[agent.name] = {
+          installed: false,
+          label: agent.label,
+        };
+      }
     }
   }
   return detected;
@@ -377,7 +422,7 @@ function createRelayConnection(wsUrl, config = {}) {
  */
 export async function connectToServer(options = {}) {
   const config = loadConfig();
-  const serverUrl = options.server || config.server || 'https://upfynai.thinqmesh.com';
+  const serverUrl = options.server || config.server || 'https://upfynai-code-production.up.railway.app';
   const relayKey = options.key || config.relayKey;
 
   if (!relayKey) {
@@ -510,6 +555,14 @@ export async function connectToServer(options = {}) {
     ws.on('error', (err) => {
       if (err.code === 'ECONNREFUSED') {
         spinner.fail(`Cannot reach ${serverUrl}. Is the server running?`);
+      } else if (err.message?.includes('401')) {
+        spinner.fail('Authentication failed (401). Your relay token may be invalid or expired.');
+        logRelayEvent('!', 'Get a new token from the dashboard: https://cli.upfyn.com/dashboard', 'yellow');
+        logRelayEvent('!', 'Then run: uc connect --server <url> --key <new_token>', 'yellow');
+      } else if (err.message?.includes('403') || err.message?.includes('Forbidden')) {
+        spinner.fail('Access forbidden (403). Your account may be inactive.');
+      } else {
+        logRelayEvent('!', `WebSocket error: ${err.message || err.code || 'unknown'}`, 'red');
       }
       // close handler will trigger reconnect
     });