vibex-sh 0.1.0 → 0.1.1

package/index.js

@@ -10,11 +10,19 @@ import http from 'http';
 import https from 'https';
 
 function generateSessionId() {
+  // Generate secure random session ID with 12 characters (as per security plan)
+  // Format: vibex-{12 random alphanumeric chars}
+  // Using crypto for better randomness
+  const crypto = require('crypto');
   const chars = 'abcdefghijklmnopqrstuvwxyz0123456789';
   let result = 'vibex-';
-  for (let i = 0; i < 6; i++) {
-    result += chars[Math.floor(Math.random() * chars.length)];
+  
+  // Use crypto.randomBytes for cryptographically secure random generation
+  const randomBytes = crypto.randomBytes(12);
+  for (let i = 0; i < 12; i++) {
+    result += chars[randomBytes[i] % chars.length];
   }
+  
   return result;
 }
 
@@ -148,7 +156,7 @@ async function handleLogin(webUrl) {
   const configPath = getConfigPath();
   const existingConfig = getStoredConfig();
   
-  console.log('\n  🔐 Vibex CLI Authentication\n');
+  console.log('\n  🔐 vibex.sh CLI Authentication\n');
   console.log(`  📁 Config location: ${configPath}`);
   
   if (existingConfig?.token) {
@@ -235,7 +243,7 @@ function httpRequest(url, options) {
 }
 
 async function claimSession(sessionId, token, webUrl) {
-  if (!token) return false;
+  if (!token) return null; // Return null instead of false to indicate no claim attempted
   
   try {
     // Normalize session ID before claiming
@@ -249,21 +257,37 @@ async function claimSession(sessionId, token, webUrl) {
       }),
     });
     
-    return response.ok;
+    if (response.ok) {
+      // Parse response to get auth code
+      const responseData = await response.json();
+      return responseData.authCode || null;
+    }
+    
+    return null;
   } catch (error) {
-    return false;
+    return null;
   }
 }
 
-function printBanner(sessionId, webUrl) {
-  const dashboardUrl = `${webUrl}/${sessionId}`;
+// Removed getSessionAuthCode - auth codes should only come from:
+// 1. claim-session-with-token response (for claimed sessions)
+// 2. socket.io session-auth-code event (for unclaimed sessions)
+// Never fetch auth codes via public API endpoint - security vulnerability 
+
+function printBanner(sessionId, webUrl, authCode = null) {
+  const dashboardUrl = authCode 
+    ? `${webUrl}/${sessionId}?auth=${authCode}`
+    : `${webUrl}/${sessionId}`;
   
   console.log('\n');
   console.log('  ╔═══════════════════════════════════════╗');
-  console.log('  ║         🔍 Vibex is watching...      ║');
+  console.log('  ║         🔍 vibex.sh is watching...      ║');
   console.log('  ╚═══════════════════════════════════════╝');
   console.log('\n');
   console.log(`  Session ID: ${sessionId}`);
+  if (authCode) {
+    console.log(`  Auth Code:  ${authCode}`);
+  }
   console.log(`  Dashboard:  ${dashboardUrl}`);
   console.log('\n');
 }
@@ -322,26 +346,36 @@ async function main() {
   // Get token from flag, env var, or stored config
   let token = options.token || process.env.VIBEX_TOKEN || await getStoredToken();
   
-  // Auto-claim session if token is available
+  // Auto-claim session if token is available and fetch auth code
+  let authCode = null;
   if (token && !options.sessionId) {
     // Only auto-claim new sessions (not when reusing existing session)
-    const claimed = await claimSession(sessionId, token, webUrl);
-    if (claimed) {
+    authCode = await claimSession(sessionId, token, webUrl);
+    if (authCode) {
       console.log('  ✓ Session automatically claimed to your account\n');
     }
   }
+  
+  // For unclaimed sessions, auth code will come from socket.io 'session-auth-code' event
+  // We'll set it when we receive it from the socket
 
   // Print banner only once, and show how to reuse session
   if (!options.sessionId) {
-    printBanner(sessionId, webUrl);
+    printBanner(sessionId, webUrl, authCode);
     const localFlag = webUrl.includes('localhost') ? ' --local' : '';
     const sessionSlug = sessionId.replace(/^vibex-/, ''); // Remove prefix for example
     console.log('  💡 Tip: Use -s to send more logs to this session');
     console.log(`  Example: echo '{"cpu": 45, "memory": 78, "timestamp": "${new Date().toISOString()}"}' | npx vibex-sh -s ${sessionSlug}${localFlag}\n`);
   } else {
     // When reusing a session, show minimal info
+    const dashboardUrl = authCode 
+      ? `${webUrl}/${sessionId}?auth=${authCode}`
+      : `${webUrl}/${sessionId}`;
     console.log(`  🔍 Sending logs to session: ${sessionId}`);
-    console.log(`  Dashboard: ${webUrl}/${sessionId}\n`);
+    if (authCode) {
+      console.log(`  Auth Code: ${authCode}`);
+    }
+    console.log(`  Dashboard: ${dashboardUrl}\n`);
   }
 
   const socket = io(socketUrl, {
@@ -359,6 +393,9 @@ async function main() {
   let hasJoinedSession = false;
   const logQueue = [];
 
+  // Store auth code received from socket
+  let receivedAuthCode = authCode;
+
   socket.on('connect', () => {
     isConnected = true;
     console.log('  ✓ Connected to server\n');
@@ -378,6 +415,16 @@ async function main() {
     }, 100);
   });
 
+  // Listen for auth code from socket.io (for unclaimed sessions)
+  socket.on('session-auth-code', (data) => {
+    if (data.sessionId === sessionId && data.authCode && !receivedAuthCode) {
+      receivedAuthCode = data.authCode;
+      // Display auth code when received (for both new and existing sessions)
+      console.log(`  🔑 Auth Code: ${receivedAuthCode}`);
+      console.log(`  📋 Dashboard: ${webUrl}/${sessionId}?auth=${receivedAuthCode}\n`);
+    }
+  });
+
   socket.on('reconnect', (attemptNumber) => {
     console.log(`  ↻ Reconnected (attempt ${attemptNumber})\n`);
     isConnected = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibex-sh",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Zero-config observability CLI - pipe logs and visualize instantly",
   "type": "module",
   "bin": {