viveworker 0.8.6 → 0.8.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viveworker",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "Mobile control plane for AI agents. Approve, answer, and hand off work for Codex, Claude, MCP-ready tools, and A2A from one phone.",
   "author": "Yuta Hoshino <hoshino.lireneo@gmail.com>",
   "license": "MIT",

package/scripts/a2a-cli.mjs

@@ -18,7 +18,7 @@
 import { promises as fs } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { upsertEnvText } from "./lib/pairing.mjs";
 
 const A2A_ENV_FILE = path.join(os.homedir(), ".viveworker", "a2a.env");
@@ -355,13 +355,30 @@ async function fetchJson(url, options = {}) {
 }
 
 function openBrowser(url) {
+  // authUrl comes from the relay response, so a malicious or compromised relay
+  // (or a user pointed at one via --relay-url) must not be able to smuggle shell
+  // metacharacters into a command line. Parse and require http(s), then hand the
+  // URL to the OS opener as a single argv entry via execFileSync (no shell) so
+  // it can never be reinterpreted as a command.
+  let target;
+  try {
+    const parsed = new URL(String(url));
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      console.log(`   (refusing to auto-open a non-http(s) URL — open it manually)`);
+      return;
+    }
+    target = parsed.toString();
+  } catch {
+    console.log(`   (could not parse the authorization URL — open it manually)`);
+    return;
+  }
   try {
     if (process.platform === "darwin") {
-      execSync(`open "${url}"`, { stdio: "ignore" });
+      execFileSync("open", [target], { stdio: "ignore" });
     } else if (process.platform === "linux") {
-      execSync(`xdg-open "${url}"`, { stdio: "ignore" });
+      execFileSync("xdg-open", [target], { stdio: "ignore" });
     } else if (process.platform === "win32") {
-      execSync(`start "" "${url}"`, { stdio: "ignore" });
+      execFileSync("rundll32", ["url.dll,FileProtocolHandler", target], { stdio: "ignore" });
     }
   } catch {
     // Browser open failed — URL is already printed for manual use

package/scripts/viveworker-bridge.mjs

@@ -37,6 +37,7 @@ const {
   bootstrapPasskeyAccount,
   completePasskeyAssertion,
   completePasskeyRegistration,
+  listPasskeyDevices,
   listSupportedChains,
   requestEmailOtp: requestHazbaseEmailOtp,
   requestPasskeyAssertionChallenge,
@@ -1549,11 +1550,19 @@ function normalizeTrustedReadTokens(tokens) {
   }
   if (strippedTokens.some((token) => {
     const value = String(token || "");
-    return (
-      ["||", "&&", ";", "&"].includes(value) ||
-      value.includes("`") ||
-      value.includes("$(")
-    );
+    if (value === "|") {
+      // A standalone pipe is the only operator allowed here; the pipe-stage
+      // split below validates that each downstream stage is an allow-listed
+      // post-processor (head/tail/wc).
+      return false;
+    }
+    // Reject any token that *contains* a command separator or command
+    // substitution, not just tokens that equal one. The whitespace tokenizer
+    // keeps separators attached to adjacent text (e.g. "README.md;id" or
+    // "README.md|sh"), so a whole-token equality check let the shell run an
+    // injected second command the classifier never saw. A substring check on
+    // ; & | and backtick (plus "$(") closes that gap.
+    return /[;&|`]/u.test(value) || value.includes("$(");
   })) {
     return null;
   }
@@ -1587,6 +1596,14 @@ function evaluateTrustedReadCommandPolicy({ commandText, cwd, workspaceRoot }) {
   const normalizedCwd = cleanText(cwd || "");
   const normalizedWorkspaceRoot = cleanText(workspaceRoot || normalizedCwd);
   const normalizedCommandText = unwrapShellCommand(commandText);
+  // A literal newline or carriage return is a shell command separator, but
+  // tokenizeShellWords() treats it as ordinary whitespace — so an injected
+  // second command (e.g. "rg foo\ntouch evil") would be split into harmless
+  // looking word tokens and misclassified as a single safe read. Refuse to
+  // auto-classify anything carrying these so it falls back to manual approval.
+  if (/[\n\r]/u.test(normalizedCommandText)) {
+    return null;
+  }
   const rawTokens = tokenizeShellWords(normalizedCommandText);
   if (!normalizedCommandText || !normalizedCwd || !normalizedWorkspaceRoot || rawTokens.length === 0) {
     return null;
@@ -10486,6 +10503,45 @@ function isHiddenCodexApprovalAssessmentText(text) {
   return /\bThe following is the Codex agent history(?: added since your last approval assessment)?\b/iu.test(single);
 }
 
+function isHiddenCodexApprovalDecisionJsonText(text) {
+  const single = cleanText(stripNotificationMarkup(stripEnvironmentContextBlocks(text || "")));
+  if (!single || !single.startsWith("{") || !single.endsWith("}")) {
+    return false;
+  }
+
+  const parsed = safeJsonParse(single);
+  if (!isPlainObject(parsed)) {
+    return false;
+  }
+
+  const allowedKeys = new Set(["risk_level", "user_authorization", "outcome", "rationale"]);
+  const keys = Object.keys(parsed);
+  if (!keys.includes("outcome") || keys.some((key) => !allowedKeys.has(key))) {
+    return false;
+  }
+
+  const outcome = cleanText(parsed.outcome || "");
+  if (outcome !== "allow" && outcome !== "deny") {
+    return false;
+  }
+
+  const riskLevel = cleanText(parsed.risk_level || "");
+  if (riskLevel && !["low", "medium", "high", "critical"].includes(riskLevel)) {
+    return false;
+  }
+
+  const userAuthorization = cleanText(parsed.user_authorization || "");
+  if (userAuthorization && !["unknown", "low", "medium", "high"].includes(userAuthorization)) {
+    return false;
+  }
+
+  if (parsed.rationale != null && typeof parsed.rationale !== "string") {
+    return false;
+  }
+
+  return keys.length === 1 || keys.some((key) => key === "risk_level" || key === "user_authorization" || key === "rationale");
+}
+
 function shouldHideInternalTimelineItem(item) {
   return shouldHideClaudeInternalItem(item) || shouldHideCodexInternalApprovalItem(item) || shouldHideMoltbookHarnessItem(item);
 }
@@ -10563,14 +10619,23 @@ function shouldHideCodexInternalApprovalItem(item) {
 
   const title = cleanText(item.title ?? "");
   const threadLabel = cleanText(item.threadLabel ?? "");
-  if (isHiddenCodexApprovalAssessmentText(title) || isHiddenCodexApprovalAssessmentText(threadLabel)) {
+  if (
+    isHiddenCodexApprovalAssessmentText(title) ||
+    isHiddenCodexApprovalAssessmentText(threadLabel) ||
+    isHiddenCodexApprovalDecisionJsonText(title) ||
+    isHiddenCodexApprovalDecisionJsonText(threadLabel)
+  ) {
     return true;
   }
   return (
     isHiddenCodexApprovalAssessmentText(item.messageText) ||
     isHiddenCodexApprovalAssessmentText(item.summary) ||
     isHiddenCodexApprovalAssessmentText(item.detailText) ||
-    isHiddenCodexApprovalAssessmentText(item.message)
+    isHiddenCodexApprovalAssessmentText(item.message) ||
+    isHiddenCodexApprovalDecisionJsonText(item.messageText) ||
+    isHiddenCodexApprovalDecisionJsonText(item.summary) ||
+    isHiddenCodexApprovalDecisionJsonText(item.detailText) ||
+    isHiddenCodexApprovalDecisionJsonText(item.message)
   );
 }
 
@@ -15656,7 +15721,7 @@ function resolveManifestPairingToken({ config, state, requestedToken }) {
   if (!isPairingAvailable(config)) {
     return "";
   }
-  return cleanText(config.pairingToken) === token ? token : "";
+  return constantTimeStringEqual(cleanText(config.pairingToken), token) ? token : "";
 }
 
 function buildWebManifest({ pairToken }) {
@@ -15691,7 +15756,7 @@ function buildWebManifest({ pairToken }) {
   );
 }
 
-function buildWebAppHtml({ pairToken }) {
+function buildWebAppHtml({ pairToken, nonce }) {
   const manifestHref = pairToken
     ? `/manifest.webmanifest?pairToken=${encodeURIComponent(pairToken)}`
     : "/manifest.webmanifest";
@@ -15814,7 +15879,7 @@ function buildWebAppHtml({ pairToken }) {
       </div>
     </div>
     <div id="app"></div>
-    <script>
+    <script nonce="${nonce}">
       (() => {
         const isJa = (navigator.language || "").toLowerCase().startsWith("ja");
         const message = isJa ? "同じWi-Fi内のPCを確認中..." : "Checking your trusted Wi-Fi...";
@@ -16099,10 +16164,22 @@ function createNativeApprovalServer({ config, runtime, state }) {
           state,
           requestedToken: url.searchParams.get("pairToken"),
         });
+        const cspNonce = crypto.randomBytes(16).toString("base64url");
         res.statusCode = 200;
         res.setHeader("Content-Type", "text/html; charset=utf-8");
         res.setHeader("Cache-Control", "no-store, max-age=0");
-        res.end(buildWebAppHtml({ pairToken }));
+        // Defense-in-depth against XSS in the control-plane PWA: this document
+        // renders server-built HTML that can contain untrusted agent content,
+        // so lock script execution to same-origin plus the single nonce'd inline
+        // boot script. Without 'unsafe-inline', an injected <script>, onerror=
+        // handler, or javascript: URL cannot run even if it slips past the
+        // markdown sanitizer. img/style/connect are intentionally left to the
+        // browser default so remote connection, wallet, and images keep working.
+        res.setHeader(
+          "Content-Security-Policy",
+          `script-src 'self' 'nonce-${cspNonce}'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'`
+        );
+        res.end(buildWebAppHtml({ pairToken, nonce: cspNonce }));
         return;
       }
 
@@ -16233,7 +16310,7 @@ function createNativeApprovalServer({ config, runtime, state }) {
       const apiA2ATaskStatus = url.pathname.match(/^\/api\/providers\/a2a\/tasks\/([^/]+)\/status$/u);
       if (apiA2ATaskStatus && req.method === "GET") {
         const apiKey = req.headers["x-a2a-key"] || "";
-        if (!config.a2aApiKey || apiKey !== config.a2aApiKey) {
+        if (!config.a2aApiKey || !constantTimeStringEqual(apiKey, config.a2aApiKey)) {
           return writeJson(res, 401, { error: "unauthorized" });
         }
         const token = decodeURIComponent(apiA2ATaskStatus[1]);
@@ -16702,7 +16779,7 @@ function createNativeApprovalServer({ config, runtime, state }) {
 
 if (url.pathname === "/api/hazbase/status" && req.method === "GET") {
   const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-  const hookAuth = config.sessionSecret && hookSecret === config.sessionSecret;
+  const hookAuth = config.sessionSecret && constantTimeStringEqual(hookSecret, config.sessionSecret);
   if (!hookAuth) {
     const session = requireApiSession(req, res, config, state);
     if (!session) return;
@@ -16711,12 +16788,20 @@ if (url.pathname === "/api/hazbase/status" && req.method === "GET") {
     return writeJson(res, 200, { enabled: false });
   }
   const hazbase = normalizeHazbaseState(state.hazbase);
-  const [paymentsResult, chainsResult] = await Promise.allSettled([
+  const localPasskeyRegistered = Boolean(hazbase.deviceBindingId || hazbase.credentialId);
+  const devicesPromise = hazbase.accessToken && !hazbase.sessionInvalid && !localPasskeyRegistered
+    ? listPasskeyDevices({ emailSession: hazbase.accessToken })
+    : Promise.resolve(null);
+  const [paymentsResult, chainsResult, devicesResult] = await Promise.allSettled([
     fetchHazbaseMetadata(config, "/api/meta/payments"),
     fetchHazbaseMetadata(config, "/api/meta/chains"),
+    devicesPromise,
   ]);
   const payments = paymentsResult.status === "fulfilled" ? paymentsResult.value : null;
   const chains = chainsResult.status === "fulfilled" ? chainsResult.value : null;
+  const passkeyDevices = devicesResult.status === "fulfilled" && Array.isArray(devicesResult.value?.devices)
+    ? devicesResult.value.devices
+    : [];
   const errors = [];
   if (paymentsResult.status === "rejected") {
     errors.push(paymentsResult.reason?.message || String(paymentsResult.reason || "payments metadata unavailable"));
@@ -16724,6 +16809,10 @@ if (url.pathname === "/api/hazbase/status" && req.method === "GET") {
   if (chainsResult.status === "rejected") {
     errors.push(chainsResult.reason?.message || String(chainsResult.reason || "chains metadata unavailable"));
   }
+  if (devicesResult.status === "rejected") {
+    if (await maybeWriteHazbaseSessionExpiredResponse({ error: devicesResult.reason, config, state, res })) return;
+    errors.push(devicesResult.reason?.message || String(devicesResult.reason || "passkey devices unavailable"));
+  }
   const supportedChains = Array.isArray(chains?.chains)
     ? chains.chains.filter((entry) => Boolean(paymentNetworkForChainId(Number(entry.chainId))))
         .filter((entry) => isPaymentNetworkAvailable(paymentNetworkForChainId(Number(entry.chainId))))
@@ -16759,6 +16848,8 @@ if (url.pathname === "/api/hazbase/status" && req.method === "GET") {
     sessionId: hazbase.sessionId,
     deviceBindingId: hazbase.deviceBindingId,
     credentialId: hazbase.credentialId,
+    passkeyRegistered: Boolean(localPasskeyRegistered || passkeyDevices.length),
+    passkeyDeviceCount: passkeyDevices.length,
     highTrustExpiresAt: hazbase.highTrustExpiresAt,
     accounts: hazbase.accounts,
     paymentCapabilities,
@@ -16773,7 +16864,7 @@ if (url.pathname === "/api/hazbase/status" && req.method === "GET") {
 
 if (url.pathname === "/api/hazbase/payout-address" && req.method === "GET") {
   const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-  const hookAuth = config.sessionSecret && hookSecret === config.sessionSecret;
+  const hookAuth = config.sessionSecret && constantTimeStringEqual(hookSecret, config.sessionSecret);
   if (!hookAuth) {
     const session = requireApiSession(req, res, config, state);
     if (!session) return;
@@ -17119,7 +17210,7 @@ if (url.pathname === "/api/hazbase/agent-payment-defaults" && req.method === "PO
 
 if (url.pathname === "/api/hazbase/session/refresh" && req.method === "POST") {
   const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-  const hookAuth = config.sessionSecret && hookSecret === config.sessionSecret;
+  const hookAuth = config.sessionSecret && constantTimeStringEqual(hookSecret, config.sessionSecret);
   if (!hookAuth) {
     const session = requireMutatingApiSession(req, res, config, state);
     if (!session) return;
@@ -17728,7 +17819,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
       // List known threads (active + registry) for the share target picker.
       if (url.pathname === "/api/threads/list" && req.method === "GET") {
         const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-        const hookAuth = config.sessionSecret && hookSecret === config.sessionSecret;
+        const hookAuth = config.sessionSecret && constantTimeStringEqual(hookSecret, config.sessionSecret);
         if (!hookAuth) { const session = requireApiSession(req, res, config, state); if (!session) return; }
         const codexConnected = Boolean(runtime.ipcClient?.clientId);
         const activeIds = new Set();
@@ -17772,7 +17863,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
       // Submit a thread share request (creates an approval item on the phone).
       if (url.pathname === "/api/threads/share" && req.method === "POST") {
         const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-        const hookAuth = config.sessionSecret && hookSecret === config.sessionSecret;
+        const hookAuth = config.sessionSecret && constantTimeStringEqual(hookSecret, config.sessionSecret);
         if (!hookAuth) { const session = requireApiSession(req, res, config, state); if (!session) return; }
         const body = await parseJsonBody(req);
         const shareType = cleanText(body?.shareType || "message");
@@ -18022,7 +18113,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
       // time-slot-based compose.  Defaults to full-day today.
       if (url.pathname === "/api/providers/moltbook/activity-summary" && req.method === "GET") {
         const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-        if (!config.sessionSecret || hookSecret !== config.sessionSecret) {
+        if (!config.sessionSecret || !constantTimeStringEqual(hookSecret, config.sessionSecret)) {
           return writeJson(res, 403, { error: "forbidden" });
         }
         const slot = String(url.searchParams.get("slot") || "").toLowerCase();
@@ -18197,7 +18288,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
 
       if (url.pathname === "/api/payments/x402/hazbase-wallet" && req.method === "POST") {
         const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-        if (!config.sessionSecret || hookSecret !== config.sessionSecret) {
+        if (!config.sessionSecret || !constantTimeStringEqual(hookSecret, config.sessionSecret)) {
           return writeJson(res, 401, { error: "unauthorized" });
         }
 
@@ -18287,7 +18378,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
 
       if (url.pathname === "/api/payments/x402/approval" && req.method === "POST") {
         const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-        if (!config.sessionSecret || hookSecret !== config.sessionSecret) {
+        if (!config.sessionSecret || !constantTimeStringEqual(hookSecret, config.sessionSecret)) {
           return writeJson(res, 401, { error: "unauthorized" });
         }
 
@@ -18355,7 +18446,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
 
       if (url.pathname === "/api/providers/mcp/events" && req.method === "POST") {
         const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-        if (!config.sessionSecret || hookSecret !== config.sessionSecret) {
+        if (!config.sessionSecret || !constantTimeStringEqual(hookSecret, config.sessionSecret)) {
           return writeJson(res, 401, { error: "unauthorized" });
         }
 
@@ -18371,7 +18462,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
 
       if (url.pathname === "/api/providers/claude/events" && req.method === "POST") {
         const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-        if (!config.sessionSecret || hookSecret !== config.sessionSecret) {
+        if (!config.sessionSecret || !constantTimeStringEqual(hookSecret, config.sessionSecret)) {
           return writeJson(res, 401, { error: "unauthorized" });
         }
 
@@ -18735,7 +18826,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
 
       if (url.pathname === "/api/providers/moltbook/events" && req.method === "POST") {
         const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-        if (!config.sessionSecret || hookSecret !== config.sessionSecret) {
+        if (!config.sessionSecret || !constantTimeStringEqual(hookSecret, config.sessionSecret)) {
           return writeJson(res, 401, { error: "unauthorized" });
         }
         let body;
@@ -18887,7 +18978,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
 
       if (url.pathname === "/api/providers/moltbook/draft" && req.method === "POST") {
         const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-        if (!config.sessionSecret || hookSecret !== config.sessionSecret) {
+        if (!config.sessionSecret || !constantTimeStringEqual(hookSecret, config.sessionSecret)) {
           return writeJson(res, 401, { error: "unauthorized" });
         }
         let body;
@@ -19014,7 +19105,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
       );
       if (apiMoltbookDraftDecisionGet && req.method === "GET") {
         const hookSecret = req.headers["x-viveworker-hook-secret"] || "";
-        if (!config.sessionSecret || hookSecret !== config.sessionSecret) {
+        if (!config.sessionSecret || !constantTimeStringEqual(hookSecret, config.sessionSecret)) {
           return writeJson(res, 401, { error: "unauthorized" });
         }
         const token = decodeURIComponent(apiMoltbookDraftDecisionGet[1]);
@@ -22439,8 +22530,13 @@ async function saveState(stateFile, state) {
   // single newline at the end keeps diffs/hexdumps working on the off chance
   // someone cats the file.
   const output = JSON.stringify(state);
-  await fs.mkdir(path.dirname(stateFile), { recursive: true });
-  await fs.writeFile(stateFile, `${output}\n`, "utf8");
+  await fs.mkdir(path.dirname(stateFile), { recursive: true, mode: 0o700 });
+  // state.json holds hazbase wallet tokens, push subscriptions, and device
+  // records — keep it owner-only so other local users can't read it. writeFile's
+  // mode only applies on create, so chmod explicitly to also tighten any file
+  // that was previously written world-readable.
+  await fs.writeFile(stateFile, `${output}\n`, { mode: 0o600 });
+  await fs.chmod(stateFile, 0o600).catch(() => {});
 }
 
 // ---------------------------------------------------------------------------

package/scripts/viveworker.mjs

@@ -210,7 +210,7 @@ async function runSetup(cliOptions) {
     : null;
 
   progress.update("cli.setup.progress.writeConfig");
-  await fs.mkdir(path.dirname(envFile), { recursive: true });
+  await fs.mkdir(path.dirname(envFile), { recursive: true, mode: 0o700 });
   await fs.mkdir(path.dirname(logFile), { recursive: true });
 
   const envLines = [
@@ -248,7 +248,8 @@ async function runSetup(cliOptions) {
     enableNtfy && existing.NTFY_ACCESS_TOKEN ? `NTFY_ACCESS_TOKEN=${existing.NTFY_ACCESS_TOKEN}` : null,
   ].filter(Boolean);
 
-  await fs.writeFile(envFile, `${envLines.join("\n")}\n`, "utf8");
+  await fs.writeFile(envFile, `${envLines.join("\n")}\n`, { mode: 0o600 });
+  await fs.chmod(envFile, 0o600).catch(() => {});
 
   progress.update("cli.setup.progress.providers");
   const providerSetup = await autoConfigureProvidersDuringSetup({
@@ -1455,8 +1456,9 @@ async function refreshPairingCredentials(envFile, config = {}, { force = false }
     PAIRING_TOKEN: nextPairing.pairingToken,
     PAIRING_EXPIRES_AT_MS: String(nextPairing.pairingExpiresAtMs),
   });
-  await fs.mkdir(path.dirname(envFile), { recursive: true });
-  await fs.writeFile(envFile, nextText, "utf8");
+  await fs.mkdir(path.dirname(envFile), { recursive: true, mode: 0o700 });
+  await fs.writeFile(envFile, nextText, { mode: 0o600 });
+  await fs.chmod(envFile, 0o600).catch(() => {});
 
   return {
     rotated: true,
@@ -1604,7 +1606,8 @@ async function repairDoctorIssues(cliOptions, { envFile, config, locale, hostnam
 
   const currentText = (await fileExists(envFile)) ? await fs.readFile(envFile, "utf8") : "";
   const nextText = upsertEnvText(currentText, updates);
-  await fs.writeFile(envFile, nextText, "utf8");
+  await fs.writeFile(envFile, nextText, { mode: 0o600 });
+  await fs.chmod(envFile, 0o600).catch(() => {});
   return changed;
 }
 
@@ -2059,8 +2062,9 @@ async function maybeRotateStartupPairing(envFile, config = {}) {
     PAIRING_TOKEN: nextPairing.pairingToken,
     PAIRING_EXPIRES_AT_MS: String(nextPairing.pairingExpiresAtMs),
   });
-  await fs.mkdir(path.dirname(envFile), { recursive: true });
-  await fs.writeFile(envFile, nextText, "utf8");
+  await fs.mkdir(path.dirname(envFile), { recursive: true, mode: 0o700 });
+  await fs.writeFile(envFile, nextText, { mode: 0o600 });
+  await fs.chmod(envFile, 0o600).catch(() => {});
 
   return {
     rotated: true,

package/web/app.js

@@ -6989,7 +6989,7 @@ function renderWalletInventoryCapabilityCard(hazbase, network) {
   };
   const sessionInvalid = Boolean(hazbase.sessionInvalid);
   const signedIn = Boolean(hazbase.signedIn) && !sessionInvalid;
-  const hasPasskey = Boolean(hazbase.credentialId || hazbase.deviceBindingId);
+  const hasPasskey = Boolean(hazbase.passkeyRegistered || hazbase.credentialId || hazbase.deviceBindingId);
   const configured = Boolean(capability.payTo || capability.payoutAddress || capability.smartAccountAddress);
   const needsPasskey = def?.family === "evm";
   const canConfigure = signedIn && (!needsPasskey || hasPasskey);
@@ -7052,7 +7052,7 @@ function deriveHazbaseWalletFlow(hazbase) {
   const sessionInvalid = Boolean(hazbase.sessionInvalid);
   const signedIn = Boolean(hazbase.signedIn) && !sessionInvalid;
   const passkeyHost = hazbasePasskeyHostSupport();
-  const hasPasskey = Boolean(hazbase.credentialId || hazbase.deviceBindingId);
+  const hasPasskey = Boolean(hazbase.passkeyRegistered || hazbase.credentialId || hazbase.deviceBindingId);
 
   const actionButton = (labelKey, action, { primary = false, disabled = false, attrs = "" } = {}) => {
     const pending = isHazbaseActionPending(action);
@@ -10159,7 +10159,15 @@ for (const button of document.querySelectorAll("[data-hazbase-action]")) {
         }
         const { createPasskeyRegistrationCredential } = await loadHazbasePasskeyModule();
         const challenge = await apiPost("/api/hazbase/passkey/register/challenge", {}, { timeoutMs: HAZBASE_ACTION_TIMEOUT_MS });
-        const credential = await createPasskeyRegistrationCredential(challenge);
+        let credential;
+        try {
+          credential = await createPasskeyRegistrationCredential(challenge);
+        } catch (error) {
+          if (error?.name === "InvalidStateError" || /invalid state/i.test(error?.message || String(error))) {
+            throw new Error(L("error.hazbasePasskeyAlreadyRegistered"));
+          }
+          throw error;
+        }
         await apiPost("/api/hazbase/passkey/register/complete", {
           challengeId: challenge.challengeId,
           credential,

package/web/i18n.js

@@ -704,7 +704,7 @@ const translations = {
     "settings.hazbase.status.signedIn": "Signed in",
     "settings.hazbase.status.sessionExpired": "Session expired",
     "settings.hazbase.status.otpAwaitingVerify": "Sent. Check your inbox, then enter the code below.",
-    "settings.hazbase.passkey.ready": "Registered on this device",
+    "settings.hazbase.passkey.ready": "Registered for this account",
     "settings.hazbase.passkey.missing": "Not registered yet",
     "settings.hazbase.passkey.localHostRequired": "Open viveworker on its .local hostname to register a passkey.",
     "settings.hazbase.wallet.missing": "Not issued yet",
@@ -816,6 +816,7 @@ const translations = {
     "error.hazbaseEmailRequired": "Enter your email address first.",
     "error.hazbaseOtpRequired": "Enter the one-time password.",
     "error.hazbasePasskeyLocalHostRequired": "Open viveworker on its .local hostname to use hazBase passkeys.",
+    "error.hazbasePasskeyAlreadyRegistered": "A passkey is already registered for this account. Use the existing passkey to continue.",
     "error.hazbaseWalletAccountMissing": "Issue a wallet on this chain first.",
     "error.hazbaseLiquidAddressRequired": "Enter a Liquid payout address first.",
     "error.hazbaseLiquidAddressInvalid": "Enter a valid Liquid payout address for this network.",
@@ -1830,7 +1831,7 @@ const translations = {
     "settings.hazbase.status.signedIn": "サインイン済み",
     "settings.hazbase.status.sessionExpired": "セッション切れ",
     "settings.hazbase.status.otpAwaitingVerify": "送信しました。メールを確認して、下のフィールドに入力してください。",
-    "settings.hazbase.passkey.ready": "この端末で登録済み",
+    "settings.hazbase.passkey.ready": "このアカウントで登録済み",
     "settings.hazbase.passkey.missing": "まだ登録されていません",
     "settings.hazbase.passkey.localHostRequired": ".local ホスト名で viveworker を開くとパスキーを登録できます。",
     "settings.hazbase.wallet.missing": "未発行",
@@ -1942,6 +1943,7 @@ const translations = {
     "error.hazbaseEmailRequired": "先にメールアドレスを入力してください。",
     "error.hazbaseOtpRequired": "ワンタイムパスワードを入力してください。",
     "error.hazbasePasskeyLocalHostRequired": ".local ホスト名で viveworker を開くと hazBase パスキーを使えます。",
+    "error.hazbasePasskeyAlreadyRegistered": "このアカウントには既にパスキーが登録されています。既存のパスキーで続行してください。",
     "error.hazbaseWalletAccountMissing": "先にこのチェーンのウォレットを発行してください。",
     "error.hazbaseLiquidAddressRequired": "先に Liquid payout アドレスを入力してください。",
     "error.hazbaseLiquidAddressInvalid": "このネットワーク用の有効な Liquid payout アドレスを入力してください。",

package/web/remote-pairing/transport.js

@@ -91,6 +91,14 @@ const DEFAULT_MAX_CIRCUIT_BREAKER_MS = 10 * 60_000;
 const DEFAULT_STABLE_CONNECTION_MS = 15_000;
 const DEFAULT_PROLOGUE = new TextEncoder().encode("viveworker/remote-pairing/v1");
 
+// The relay token is carried in the Sec-WebSocket-Protocol handshake header,
+// not a `?token=` query param, so it stays out of URLs and access logs. We
+// offer the fixed RELAY_SUBPROTOCOL (which the relay echoes on the 101 so the
+// handshake completes) plus the token as `${TOKEN_SUBPROTOCOL_PREFIX}<token>`.
+// Must match worker-pairing/worker.js and worker-pairing/pairing-do.js.
+const RELAY_SUBPROTOCOL = "viveworker.relay.v1";
+const TOKEN_SUBPROTOCOL_PREFIX = "vwtok.";
+
 // CloseEvent codes we emit. 1000 is normal; 4xxx is application-defined.
 const CLOSE_NORMAL = 1000;
 const CLOSE_HANDSHAKE_TIMEOUT = 4001;
@@ -354,12 +362,16 @@ export class RemotePairingTransport {
 
     const url =
       `${this._relayUrl}/v1/pairing/${encodeURIComponent(this._pairingId)}` +
-      `/ws?role=${encodeURIComponent(this._role)}` +
-      `&token=${encodeURIComponent(this._relayToken)}`;
+      `/ws?role=${encodeURIComponent(this._role)}`;
+
+    // Send the relay token via Sec-WebSocket-Protocol instead of the URL. Both
+    // the browser WebSocket and the Node `ws` package take a protocols list as
+    // the 2nd arg; the relay echoes only RELAY_SUBPROTOCOL back.
+    const subprotocols = [RELAY_SUBPROTOCOL, `${TOKEN_SUBPROTOCOL_PREFIX}${this._relayToken}`];
 
     let ws;
     try {
-      ws = new this._WebSocketImpl(url);
+      ws = new this._WebSocketImpl(url, subprotocols);
     } catch (err) {
       this._onError(err);
       this._setState(STATE.DISCONNECTED, { reason: "open-threw", error: err });