viveworker 0.8.8 → 0.8.10

package/scripts/moltbook-cli.mjs

@@ -36,6 +36,7 @@ import {
   pickInboxReplyCandidate,
   reconcileInboxDraftMarkers,
   getMoltbookReplyQuotaState,
+  loopbackFetch,
 } from "./moltbook-api.mjs";
 
 function fail(message, code = 1) {
@@ -58,10 +59,8 @@ async function resolveOnBridge(env, commentId) {
   const base = (env.VIVEWORKER_BASE_URL || "https://127.0.0.1:8810").replace(/\/+$/u, "");
   const secret = env.VIVEWORKER_HOOK_SECRET || "";
   if (!secret) return;
-  const prev = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  if (!prev) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
   try {
-    await fetch(`${base}/api/providers/moltbook/events`, {
+    await loopbackFetch(`${base}/api/providers/moltbook/events`, {
       method: "POST",
       headers: {
         "content-type": "application/json",
@@ -71,8 +70,6 @@ async function resolveOnBridge(env, commentId) {
     });
   } catch {
     // ignore
-  } finally {
-    if (!prev) process.env.NODE_TLS_REJECT_UNAUTHORIZED = prev ?? "";
   }
 }
 
@@ -596,14 +593,12 @@ async function cmdPropose(postId, flags) {
   const secret = env.VIVEWORKER_HOOK_SECRET || "";
   if (!secret) fail("VIVEWORKER_HOOK_SECRET missing (expected in ~/.viveworker/moltbook.env)");
 
-  const prevTls = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  if (!prevTls) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
 
   // Submit draft to bridge. The bridge persists it to disk and handles posting
   // on approval — the CLI exits immediately (fire-and-forget).
   let submitRes;
   try {
-    const r = await fetch(`${base}/api/providers/moltbook/draft`, {
+    const r = await loopbackFetch(`${base}/api/providers/moltbook/draft`, {
       method: "POST",
       headers: { "content-type": "application/json", "x-viveworker-hook-secret": secret },
       body: JSON.stringify({
@@ -643,7 +638,6 @@ async function cmdPropose(postId, flags) {
   }
 
   console.log(JSON.stringify({ ok: true, token, ttlSec, fireAndForget: true }));
-  if (!prevTls) process.env.NODE_TLS_REJECT_UNAUTHORIZED = prevTls ?? "";
 }
 
 async function cmdMarkScoutSeen(postId) {
@@ -907,8 +901,6 @@ async function cmdCompose(flags) {
   const secret = env.VIVEWORKER_HOOK_SECRET || "";
   if (!secret) fail("VIVEWORKER_HOOK_SECRET missing");
 
-  const prevTls = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  if (!prevTls) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
 
   const state = rollScoutDayIfNeeded(await readScoutState());
   const maxCompose = Number(flags["max-daily"]) || 3;
@@ -942,7 +934,7 @@ async function cmdCompose(flags) {
   // Fetch activity summary from bridge.
   let summary;
   try {
-    const r = await fetch(`${base}/api/providers/moltbook/activity-summary?${params}`, {
+    const r = await loopbackFetch(`${base}/api/providers/moltbook/activity-summary?${params}`, {
       headers: { "x-viveworker-hook-secret": secret },
     });
     if (!r.ok) fail(`activity-summary: ${r.status}`);
@@ -978,7 +970,6 @@ async function cmdCompose(flags) {
     maxComposeDaily: maxCompose,
   }));
 
-  if (!prevTls) process.env.NODE_TLS_REJECT_UNAUTHORIZED = prevTls ?? "";
 }
 
 async function cmdComposePropose(flags) {
@@ -996,8 +987,6 @@ async function cmdComposePropose(flags) {
   const secret = env.VIVEWORKER_HOOK_SECRET || "";
   if (!secret) fail("VIVEWORKER_HOOK_SECRET missing");
 
-  const prevTls = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  if (!prevTls) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
 
   const sourceId = `compose:${Date.now()}`;
 
@@ -1005,7 +994,7 @@ async function cmdComposePropose(flags) {
   // on approval — the CLI exits immediately (fire-and-forget).
   let submitRes;
   try {
-    const r = await fetch(`${base}/api/providers/moltbook/draft`, {
+    const r = await loopbackFetch(`${base}/api/providers/moltbook/draft`, {
       method: "POST",
       headers: { "content-type": "application/json", "x-viveworker-hook-secret": secret },
       body: JSON.stringify({
@@ -1033,7 +1022,6 @@ async function cmdComposePropose(flags) {
   if (!token) fail(`bridge did not return a token: ${JSON.stringify(submitRes)}`);
 
   console.log(JSON.stringify({ ok: true, token, ttlSec, fireAndForget: true }));
-  if (!prevTls) process.env.NODE_TLS_REJECT_UNAUTHORIZED = prevTls ?? "";
 }
 
 export async function runMoltbookCli(argv) {

package/scripts/moltbook-watcher.mjs

@@ -17,14 +17,8 @@
 import http from "node:http";
 import process from "node:process";
 
-// The bridge usually listens on HTTPS with a self-signed certificate. Since
-// we only ever talk to it on loopback, disable TLS verification for outgoing
-// fetch calls from this process. Scoped to the watcher process only.
-if (!process.env.NODE_TLS_REJECT_UNAUTHORIZED) {
-  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-}
-
 import {
+  loopbackFetch,
   createMoltbookClient,
   extractNotifications,
   isCommentNotification,
@@ -81,7 +75,7 @@ async function pushToBridge(item) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), 10_000);
   try {
-    const res = await fetch(`${VIVEWORKER_BASE}/api/providers/moltbook/events`, {
+    const res = await loopbackFetch(`${VIVEWORKER_BASE}/api/providers/moltbook/events`, {
       method: "POST",
       headers: {
         "content-type": "application/json",

package/scripts/share-cli.mjs

@@ -1007,9 +1007,28 @@ function selectSupportedPaymentRequirement(x402, flags = {}) {
 
 function summarizeRequirement(requirement) {
   const network = SUPPORTED_BUYER_NETWORKS[String(requirement.network)];
-  const assetKey = String(requirement.extra?.asset || "").toLowerCase();
-  const decimals = Number(requirement.extra?.decimals ?? (String(requirement.scheme || "") === LIQUID_X402_SCHEME ? 8 : 6));
-  const assetLabel = PAYMENT_ASSETS[assetKey]?.label || (String(requirement.scheme || "") === LIQUID_X402_SCHEME ? "USDt" : "USDC");
+  const isLiquid = String(requirement.scheme || "") === LIQUID_X402_SCHEME;
+  // SECURITY: never trust the seller-supplied requirement.extra.decimals or the
+  // free-form asset label for the amount shown to / approved by the human.
+  // Resolve the asset against the network's known assets and take decimals +
+  // label from the trusted PAYMENT_ASSETS table, so the displayed/approved
+  // amount always matches what is actually signed (the atomic maxAmountRequired).
+  // Otherwise a hostile seller could advertise inflated decimals to make the
+  // phone show a tiny amount while a much larger value is authorized.
+  const claimedAssetKey = String(requirement.extra?.asset || "").toLowerCase();
+  const resolvedAsset =
+    normalizePaymentAsset(claimedAssetKey, String(requirement.network)) || (isLiquid ? "usdt" : "usdc");
+  const trustedAsset = PAYMENT_ASSETS[resolvedAsset] || PAYMENT_ASSETS[isLiquid ? "usdt" : "usdc"];
+  const decimals = trustedAsset.decimals;
+  const assetLabel = trustedAsset.label;
+  // Refuse if the seller advertised decimals that disagree with the known token
+  // decimals — the 402 is malformed or is attempting an amount-display spoof.
+  const advertisedDecimals = requirement.extra?.decimals;
+  if (advertisedDecimals != null && Number(advertisedDecimals) !== decimals) {
+    throw new Error(
+      `x402 requirement decimals (${advertisedDecimals}) do not match the known ${assetLabel} decimals (${decimals}) on ${requirement.network}; refusing to sign a possibly spoofed amount.`
+    );
+  }
   return {
     network: String(requirement.network),
     chainId: network?.chainId ?? null,
@@ -1019,8 +1038,11 @@ function summarizeRequirement(requirement) {
     amountUsdc: formatAtomicAmount(requirement.maxAmountRequired, decimals),
     assetLabel,
     payTo: String(requirement.payTo),
+    // The on-chain token contract that will actually be signed against. Surfaced
+    // (printPaymentSummary / phone approval payload) so a seller cannot label a
+    // payment "USDC" while pointing requirement.asset at a different token.
     asset: String(requirement.asset),
-    assetKey,
+    assetKey: resolvedAsset,
     resource: String(requirement.resource || ""),
     description: String(requirement.description || ""),
   };
@@ -1031,6 +1053,7 @@ function printPaymentSummary(summary) {
   console.log("");
   console.log(`${summary.paid ? "Paid" : "Payment required"} — ${summary.amount} ${summary.assetLabel} on ${network?.label || summary.network}`);
   console.log(`   to: ${summary.payTo}`);
+  if (summary.asset) console.log(`   token contract: ${summary.asset}`);
   if (summary.payer) console.log(`   from: ${summary.payer}`);
   if (summary.resource) console.log(`   resource: ${summary.resource}`);
   console.log("");

package/scripts/viveworker-bridge.mjs

@@ -4,7 +4,7 @@ import { spawn } from "node:child_process";
 import crypto from "node:crypto";
 import { createServer as createHttpServer } from "node:http";
 import { createServer as createHttpsServer } from "node:https";
-import { promises as fs, readFileSync, createReadStream, watch as watchFs } from "node:fs";
+import { promises as fs, readFileSync, realpathSync, createReadStream, watch as watchFs } from "node:fs";
 import net from "node:net";
 import os from "node:os";
 import path from "node:path";
@@ -231,7 +231,7 @@ async function flushPendingStateWrite(config, state) {
 const cli = parseCliArgs(process.argv.slice(2));
 const envFile = resolveEnvFile(cli.envFile);
 loadEnvFile(envFile);
-loadEnvFile(path.join(os.homedir(), ".viveworker", "a2a.env"));
+loadEnvFile(path.join(os.homedir(), ".viveworker", "a2a.env"), { allowKeys: (key) => key.startsWith("A2A_") });
 loadEnvFile(path.join(os.homedir(), ".viveworker", "remote-pairing.env"));
 await maybeRotateStartupPairingEnv(envFile);
 
@@ -1233,6 +1233,79 @@ function isSensitiveCommandPath(candidatePath) {
   return false;
 }
 
+// Confine a stored timeline image path to the dirs the bridge itself writes
+// attachments into. Timeline entries can be created by SESSION_SECRET-authed
+// ingestion paths (provider/timeline events) that set entry.imagePaths to an
+// arbitrary absolute path; the per-path HMAC is signed by the bridge over that
+// same path, so it is NOT a confinement control. The /api/timeline image route
+// fs.readFile()s whatever this resolves to, so confinement MUST happen here.
+// Returns the original path string on success; fails closed ("") for anything
+// outside the roots, non-existent files, symlink escapes, sensitive names, or
+// missing config.
+function resolveConfinedTimelineImagePath(config, candidatePath) {
+  const normalized = cleanText(candidatePath || "");
+  if (!normalized || !path.isAbsolute(normalized)) {
+    return "";
+  }
+  if (isSensitiveCommandPath(normalized)) {
+    return "";
+  }
+  const roots = [config?.timelineAttachmentsDir, config?.replyUploadsDir]
+    .map((root) => cleanText(root || ""))
+    .filter(Boolean);
+  if (roots.length === 0) {
+    return "";
+  }
+  let canonicalTarget;
+  try {
+    canonicalTarget = realpathSync(normalized);
+  } catch {
+    return "";
+  }
+  for (const root of roots) {
+    let canonicalRoot;
+    try {
+      canonicalRoot = realpathSync(root);
+    } catch {
+      continue;
+    }
+    if (isPathWithinRoot(canonicalRoot, canonicalTarget)) {
+      return normalized;
+    }
+  }
+  return "";
+}
+
+function realpathNearestExistingAncestor(resolvedPath) {
+  // Walk up from resolvedPath to the nearest ancestor that exists on disk,
+  // realpath that ancestor (following any symlinks), and re-attach the
+  // not-yet-existing trailing segments. Returns the canonicalized full path, or
+  // null if no ancestor can be canonicalized. This lets a non-existent
+  // write/read target still be symlink-checked via its existing parent dir.
+  const normalized = cleanText(resolvedPath || "");
+  if (!normalized) {
+    return null;
+  }
+  const trailing = [];
+  let current = normalized;
+  for (let depth = 0; depth < 4096; depth += 1) {
+    let canonicalAncestor;
+    try {
+      canonicalAncestor = realpathSync(current);
+    } catch {
+      const parent = path.dirname(current);
+      if (parent === current) {
+        return null;
+      }
+      trailing.unshift(path.basename(current));
+      current = parent;
+      continue;
+    }
+    return trailing.length === 0 ? canonicalAncestor : path.join(canonicalAncestor, ...trailing);
+  }
+  return null;
+}
+
 function resolveTrustedReadTargetPath({ token, cwd, workspaceRoot }) {
   const rawToken = cleanText(token || "");
   const normalizedCwd = cleanText(cwd || "");
@@ -1243,11 +1316,57 @@ function resolveTrustedReadTargetPath({ token, cwd, workspaceRoot }) {
   if (rawToken === "-" || rawToken.startsWith("~") || rawToken.startsWith("http://") || rawToken.startsWith("https://")) {
     return null;
   }
+  // Reject shell-active metacharacters in a path argument. The classifier
+  // resolves the token lexically (path.resolve does NOT expand them), but the
+  // agent later runs the ORIGINAL command through a shell that WOULD expand
+  // globs (* ? [ ]), brace lists ({a,b}) and variables ($VAR / ${VAR}) — reading
+  // files the classifier never vetted (e.g. "cat *.env", "cat {x,/etc/passwd}").
+  if (/[*?[\]{}$]/.test(rawToken)) {
+    return null;
+  }
   const resolved = path.resolve(normalizedCwd, rawToken);
-  if (!isPathWithinRoot(normalizedWorkspaceRoot, resolved)) {
+  // Canonicalize via realpath so an in-workspace symlink cannot redirect the
+  // read at an existing file outside the root or at a sensitive path. Root and
+  // target are both realpath'd so platform symlinks (e.g. macOS /var ->
+  // /private/var) do not cause false negatives.
+  let canonicalTarget;
+  try {
+    canonicalTarget = realpathSync(resolved);
+  } catch {
+    // The target does not exist yet (e.g. a flag value like the "5" in
+    // `head -n 5` mis-parsed as a path, or a not-yet-created WRITE target). The
+    // target's PARENT may still be an in-workspace symlink that redirects the
+    // write/read outside the root (e.g. "notes -> /etc" with "notes/readme.md").
+    // Canonicalize via the nearest existing ancestor and re-check confinement
+    // against the realpath'd root. Fail closed if nothing can be canonicalized.
+    const canonicalNonExistent = realpathNearestExistingAncestor(resolved);
+    if (!canonicalNonExistent) {
+      return null;
+    }
+    let canonicalRootForMissing;
+    try {
+      canonicalRootForMissing = realpathSync(normalizedWorkspaceRoot);
+    } catch {
+      return null;
+    }
+    if (!isPathWithinRoot(canonicalRootForMissing, canonicalNonExistent)) {
+      return null;
+    }
+    if (isSensitiveCommandPath(canonicalNonExistent)) {
+      return null;
+    }
+    return resolved;
+  }
+  let canonicalRoot;
+  try {
+    canonicalRoot = realpathSync(normalizedWorkspaceRoot);
+  } catch {
     return null;
   }
-  if (isSensitiveCommandPath(resolved)) {
+  if (!isPathWithinRoot(canonicalRoot, canonicalTarget)) {
+    return null;
+  }
+  if (isSensitiveCommandPath(canonicalTarget)) {
     return null;
   }
   return resolved;
@@ -1592,6 +1711,29 @@ function normalizeTrustedReadTokens(tokens) {
   return stages[0];
 }
 
+function commandHasDangerousReadFlag(tokens) {
+  // Read-tool options that execute external commands or read arbitrary files.
+  const longDanger = ["--pre", "--pre-glob", "--hostname-bin", "--search-zip", "--file", "--config", "--ext-diff", "--textconv"];
+  for (const token of tokens) {
+    const value = String(token || "");
+    if (!value.startsWith("-")) {
+      continue;
+    }
+    if (longDanger.some((flag) => value === flag || value.startsWith(`${flag}=`))) {
+      return true;
+    }
+    // Single-dash short clusters carrying a value-taking dangerous flag:
+    // ripgrep -f (read a patterns file) and -z (run decompressors). A value-
+    // taking short flag must be last in its cluster, so any single-dash token
+    // containing lowercase f or z is rejected. Uppercase -F/-Z and long options
+    // (--fixed-strings etc.) are unaffected.
+    if (!value.startsWith("--") && /[fz]/.test(value)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 function evaluateTrustedReadCommandPolicy({ commandText, cwd, workspaceRoot }) {
   const normalizedCwd = cleanText(cwd || "");
   const normalizedWorkspaceRoot = cleanText(workspaceRoot || normalizedCwd);
@@ -1618,6 +1760,16 @@ function evaluateTrustedReadCommandPolicy({ commandText, cwd, workspaceRoot }) {
     return null;
   }
 
+  // Reject read-tool flags that execute external commands or read arbitrary
+  // files (ripgrep --pre= / --hostname-bin= / -f patternfile / -z search-zip,
+  // git --ext-diff / --textconv, ...). The per-command branches below skip
+  // "-"-prefixed tokens without inspecting their values, so without this guard
+  // `rg --pre=/tmp/evil foo .` would auto-approve and ripgrep would execute the
+  // attacker-named command.
+  if (commandHasDangerousReadFlag(tokens)) {
+    return null;
+  }
+
   const command = commandBaseName(tokens[0]);
   if (!command || /^[A-Za-z_][A-Za-z0-9_]*=.*/u.test(command)) {
     return null;
@@ -1651,11 +1803,6 @@ function unwrapShellCommand(commandText) {
     .trim();
 }
 
-function extractCommandLineFromFunctionOutput(outputText) {
-  const match = String(outputText || "").match(/^Command:\s+(.+)$/mu);
-  return unwrapShellCommand(match?.[1] || "");
-}
-
 function parseToolArgumentsJson(value) {
   if (isPlainObject(value)) {
     return value;
@@ -1712,16 +1859,21 @@ function redactTimelineCommandText(commandText) {
     .replace(/\b([A-Z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)[A-Z0-9_]*=)(["']?)[^\s"']+\2/giu, "$1[redacted]");
 }
 
+function escapeMarkdownCodeFenceBody(text) {
+  return cleanText(text || "").replace(/```/gu, "\\`\\`\\`");
+}
+
 function timelineCommandMessage(locale, { commandText = "", toolName = "", fileRefs = [] } = {}) {
+  const safeCommandText = escapeMarkdownCodeFenceBody(redactTimelineCommandText(commandText));
   const commandBlock = commandText
-    ? `${t(locale, "server.message.commandLabel")}\n\`\`\`sh\n${redactTimelineCommandText(commandText)}\n\`\`\``
+    ? `${t(locale, "server.message.commandLabel")}\n\`\`\`sh\n${safeCommandText}\n\`\`\``
     : "";
   const toolBlock = !commandBlock && toolName
-    ? `${t(locale, "server.message.toolLabel")}\n\`\`\`text\n${cleanText(toolName)}\n\`\`\``
+    ? `${t(locale, "server.message.toolLabel")}\n\`\`\`text\n${escapeMarkdownCodeFenceBody(toolName)}\n\`\`\``
     : "";
   const files = normalizeTimelineFileRefs(fileRefs);
   const filesBlock = files.length
-    ? `${t(locale, "server.message.filesLabel")}\n\`\`\`text\n${files.join("\n")}\n\`\`\``
+    ? `${t(locale, "server.message.filesLabel")}\n\`\`\`text\n${files.map(escapeMarkdownCodeFenceBody).join("\n")}\n\`\`\``
     : "";
   return [commandBlock || toolBlock, filesBlock].filter(Boolean).join("\n\n");
 }
@@ -1851,7 +2003,7 @@ function sedCommandPathArgs(tokens) {
 function autoPilotApprovalMessage(locale, commandText) {
   const prefix = t(locale, "server.message.autoPilotTrustedReadApproved");
   const commandBlock = cleanText(commandText || "")
-    ? `${t(locale, "server.message.commandLabel")}\n\`\`\`sh\n${cleanText(commandText || "")}\n\`\`\``
+    ? `${t(locale, "server.message.commandLabel")}\n\`\`\`sh\n${escapeMarkdownCodeFenceBody(commandText)}\n\`\`\``
     : "";
   return [prefix, commandBlock].filter(Boolean).join("\n\n");
 }
@@ -4324,6 +4476,88 @@ function buildPushPayload({ config, kind, token, stableId, title, body, tab = ""
   };
 }
 
+const ALLOWED_PUSH_HOSTS = new Set([
+  "fcm.googleapis.com",
+  "android.googleapis.com",
+  "updates.push.services.mozilla.com",
+]);
+const ALLOWED_PUSH_HOST_SUFFIXES = [
+  ".push.apple.com",
+  ".notify.windows.com",
+  ".push.services.mozilla.com",
+];
+
+function isBlockedPushIpLiteral(host) {
+  const family = net.isIP(host);
+  if (family === 0) {
+    return false;
+  }
+  if (family === 6) {
+    const lower = host.toLowerCase();
+    if (lower === "::1" || lower === "::") {
+      return true;
+    }
+    const mapped = lower.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/u);
+    if (mapped) {
+      return isBlockedPushIpLiteral(mapped[1]);
+    }
+    const head = parseInt(lower.split(":")[0] || "0", 16);
+    if ((head & 0xfe00) === 0xfc00) {
+      return true;
+    }
+    if ((head & 0xffc0) === 0xfe80) {
+      return true;
+    }
+    return false;
+  }
+  const parts = host.split(".").map((p) => Number(p));
+  if (parts.length !== 4 || parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) {
+    return true;
+  }
+  const [a, b] = parts;
+  if (a === 0 || a === 127) return true;
+  if (a === 10) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 192 && b === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  return false;
+}
+
+// Validate a web-push subscription endpoint before persisting it. The endpoint
+// is attacker-controllable by any session-holder; deliverWebPushItem POSTs every
+// (encrypted) notification to it, so an unrestricted endpoint is both a
+// notification-exfiltration channel and an SSRF primitive. Require https, reject
+// embedded credentials and private/loopback/link-local IP literals, and
+// allow-list the known public push provider hosts.
+function isAllowedPushEndpoint(endpoint) {
+  let parsed;
+  try {
+    parsed = new URL(String(endpoint || ""));
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "https:") {
+    return false;
+  }
+  if (parsed.username || parsed.password) {
+    return false;
+  }
+  const host = parsed.hostname.toLowerCase().replace(/^\[/u, "").replace(/\]$/u, "");
+  if (!host) {
+    return false;
+  }
+  if (isBlockedPushIpLiteral(host)) {
+    return false;
+  }
+  if (ALLOWED_PUSH_HOSTS.has(host)) {
+    return true;
+  }
+  return ALLOWED_PUSH_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix));
+}
+
 function pushSubscriptionId(endpoint) {
   return crypto.createHash("sha1").update(String(endpoint || ""), "utf8").digest("hex").slice(0, 24);
 }
@@ -6846,11 +7080,6 @@ async function buildRolloutFileTimelineEntries({ config, record, fileState, runt
       });
       return [];
     }
-    const commandText = extractCommandLineFromFunctionOutput(payload.output ?? "");
-    if (!commandText) {
-      return [];
-    }
-    const classified = classifyTimelineCommand(commandText);
     upsertTimelineActivity({
       config,
       runtime,
@@ -6862,19 +7091,7 @@ async function buildRolloutFileTimelineEntries({ config, record, fileState, runt
       source: "codex-tool-output",
       atMs: createdAtMs,
     });
-    return [
-      buildToolTimelineEntry({
-        provider: "codex",
-        threadId,
-        threadLabel,
-        callId,
-        createdAtMs,
-        fileEventType: classified.fileEventType,
-        commandText: classified.commandText || commandText,
-        fileRefs: classified.fileRefs,
-        cwd: fileState.cwd || "",
-      }),
-    ].filter(Boolean);
+    return [];
   }
 
   if (payloadType === "custom_tool_call_output") {
@@ -10799,7 +11016,7 @@ function formatCommandApprovalMessage(params, locale = config?.defaultLocale ||
     parts.push(t(locale, "server.message.commandApprovalNeeded"));
   }
   if (command) {
-    parts.push(`${t(locale, "server.message.commandLabel")}\n\`\`\`sh\n${command}\n\`\`\``);
+    parts.push(`${t(locale, "server.message.commandLabel")}\n\`\`\`sh\n${escapeMarkdownCodeFenceBody(command)}\n\`\`\``);
   }
   return parts.join("\n\n") || t(locale, "server.message.commandApprovalNeeded");
 }
@@ -12027,6 +12244,10 @@ function normalizePushSubscriptionBody(payload, deviceId) {
   if (!endpoint || !p256dh || !auth || !deviceId) {
     return null;
   }
+  if (!isAllowedPushEndpoint(endpoint)) {
+    console.warn(`[web-push] rejected subscription endpoint host: ${(() => { try { return new URL(endpoint).host; } catch { return "invalid"; } })()}`);
+    return null;
+  }
   return normalizePushSubscriptionRecord({
     id: pushSubscriptionId(endpoint),
     endpoint,
@@ -15551,7 +15772,7 @@ async function buildApiItemDetail({ config, runtime, state, kind, token, locale
   return historyItem ? buildHistoryDetail(historyItem, locale, runtime) : null;
 }
 
-function resolveTimelineEntryImagePath(runtime, state, token, index) {
+function resolveTimelineEntryImagePath(runtime, state, token, index, config) {
   const normalizedToken = cleanText(token || "");
   const entry = timelineEntryByToken(runtime, normalizedToken)
     || (state?.recentTimelineEntries ?? []).find((candidate) => cleanText(candidate?.token || "") === normalizedToken)
@@ -15561,7 +15782,9 @@ function resolveTimelineEntryImagePath(runtime, state, token, index) {
   }
   const imagePaths = normalizeTimelineImagePaths(entry.imagePaths ?? []);
   const resolvedIndex = Math.max(0, Number(index) || 0);
-  return cleanText(imagePaths[resolvedIndex] || "");
+  const candidate = cleanText(imagePaths[resolvedIndex] || "");
+  // Fail closed: only serve images confined to the attachment/upload roots.
+  return resolveConfinedTimelineImagePath(config, candidate);
 }
 
 function resolveWebAsset(urlPath) {
@@ -19275,7 +19498,7 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
       if (apiTimelineImageMatch && req.method === "GET") {
         const token = decodeURIComponent(apiTimelineImageMatch[1]);
         const index = Number(apiTimelineImageMatch[2]) || 0;
-        const filePath = resolveTimelineEntryImagePath(runtime, state, token, index);
+        const filePath = resolveTimelineEntryImagePath(runtime, state, token, index, config);
         if (!filePath) {
           res.statusCode = 404;
           res.end("not-found");
@@ -22332,9 +22555,20 @@ function parseEnvText(text) {
   return output;
 }
 
-function loadEnvFile(filePath) {
+function loadEnvFile(filePath, { allowKeys = null } = {}) {
   try {
-    Object.assign(process.env, parseEnvText(readFileSync(filePath, "utf8")));
+    const parsed = parseEnvText(readFileSync(filePath, "utf8"));
+    if (typeof allowKeys === "function") {
+      // Only copy allow-listed keys into the environment. Used for files derived
+      // from untrusted/remote data (e.g. a2a.env, written from the relay's setup
+      // response) so a tampered file cannot inject keys that override
+      // security-critical config such as AUTH_REQUIRED or SESSION_SECRET.
+      for (const [key, value] of Object.entries(parsed)) {
+        if (allowKeys(key)) process.env[key] = value;
+      }
+    } else {
+      Object.assign(process.env, parsed);
+    }
   } catch {
     // Optional env file.
   }
@@ -22409,8 +22643,12 @@ async function maybeRotateStartupPairingEnv(envFile) {
   }
 
   const nextText = upsertEnvText(currentText, updates);
-  await fs.mkdir(path.dirname(envFile), { recursive: true });
-  await fs.writeFile(envFile, nextText, "utf8");
+  await fs.mkdir(path.dirname(envFile), { recursive: true, mode: 0o700 });
+  // This env file holds the freshly-rotated PAIRING_TOKEN (trusted control-plane
+  // access) — keep it owner-only. writeFile's mode only applies on create, so
+  // chmod explicitly to also tighten any pre-existing world-readable file.
+  await fs.writeFile(envFile, nextText, { mode: 0o600 });
+  await fs.chmod(envFile, 0o600).catch(() => {});
 }
 
 async function loadState(stateFile) {
@@ -22530,13 +22768,21 @@ async function saveState(stateFile, state) {
   // single newline at the end keeps diffs/hexdumps working on the off chance
   // someone cats the file.
   const output = JSON.stringify(state);
-  await fs.mkdir(path.dirname(stateFile), { recursive: true, mode: 0o700 });
+  const stateDir = path.dirname(stateFile);
+  const tmpFile = path.join(stateDir, `.${path.basename(stateFile)}.tmp-${process.pid}-${Date.now()}`);
+  await fs.mkdir(stateDir, { recursive: true, mode: 0o700 });
   // state.json holds hazbase wallet tokens, push subscriptions, and device
-  // records — keep it owner-only so other local users can't read it. writeFile's
-  // mode only applies on create, so chmod explicitly to also tighten any file
-  // that was previously written world-readable.
-  await fs.writeFile(stateFile, `${output}\n`, { mode: 0o600 });
-  await fs.chmod(stateFile, 0o600).catch(() => {});
+  // records — write a private temp file first so ENOSPC never truncates the
+  // last known-good state.json.
+  try {
+    await fs.writeFile(tmpFile, `${output}\n`, { mode: 0o600 });
+    await fs.chmod(tmpFile, 0o600).catch(() => {});
+    await fs.rename(tmpFile, stateFile);
+    await fs.chmod(stateFile, 0o600).catch(() => {});
+  } catch (error) {
+    await fs.unlink(tmpFile).catch(() => {});
+    throw error;
+  }
 }
 
 // ---------------------------------------------------------------------------
@@ -23905,7 +24151,7 @@ async function main() {
       if (now - lastA2aEnvCheckAt > A2A_ENV_CHECK_INTERVAL_MS) {
         lastA2aEnvCheckAt = now;
         try {
-          loadEnvFile(path.join(os.homedir(), ".viveworker", "a2a.env"));
+          loadEnvFile(path.join(os.homedir(), ".viveworker", "a2a.env"), { allowKeys: (key) => key.startsWith("A2A_") });
           const newRelayUrl = cleanText(process.env.A2A_RELAY_URL || "");
           const newRelayUserId = cleanText(process.env.A2A_RELAY_USER_ID || "");
           const newRelayRegisterSecret = cleanText(process.env.A2A_RELAY_REGISTER_SECRET || "");