zer0-agent 0.1.0 → 0.1.1

package/dist/api.js

@@ -5,6 +5,12 @@ function makeRequest(url, method, token, body) {
     return new Promise((resolve, reject) => {
         const parsed = new URL(url);
         const isHttps = parsed.protocol === "https:";
+        const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+        // SECURITY: Enforce HTTPS for non-localhost servers
+        if (!isHttps && !isLocalhost) {
+            reject(new Error(`Refusing to send agent token over insecure HTTP to ${parsed.hostname}. Use HTTPS.`));
+            return;
+        }
         const reqFn = isHttps ? httpsRequest : httpRequest;
         const options = {
             hostname: parsed.hostname,

package/dist/config.js

@@ -22,7 +22,7 @@ export function loadConfig() {
 }
 export function saveConfig(config) {
     if (!existsSync(CONFIG_DIR)) {
-        mkdirSync(CONFIG_DIR, { recursive: true });
+        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
     }
     writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n");
     // Secure the config — token should not be world-readable

package/dist/context/todos.js

@@ -1,5 +1,5 @@
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
+import { existsSync, readFileSync, lstatSync, realpathSync } from "fs";
+import { join, resolve } from "path";
 const TODO_FILES = [
     "TODO.md",
     "TODO",
@@ -9,13 +9,28 @@ const TODO_FILES = [
     "TASKS.md",
     ".todo",
 ];
+const MAX_FILE_SIZE = 50_000; // 50KB — don't read huge files
 export function gatherTodos(cwd) {
     const todos = [];
+    const resolvedCwd = resolve(cwd);
     for (const file of TODO_FILES) {
-        const filepath = join(cwd, file);
+        const filepath = join(resolvedCwd, file);
         if (!existsSync(filepath))
             continue;
         try {
+            // SECURITY: Prevent symlink attacks — only read regular files
+            // that resolve within the project directory
+            const stat = lstatSync(filepath);
+            if (stat.isSymbolicLink())
+                continue;
+            if (!stat.isFile())
+                continue;
+            if (stat.size > MAX_FILE_SIZE)
+                continue;
+            // Double-check the real path stays within the project
+            const realPath = realpathSync(filepath);
+            if (!realPath.startsWith(resolvedCwd))
+                continue;
             const content = readFileSync(filepath, "utf-8");
             const lines = content.split("\n");
             for (const line of lines) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zer0-agent",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Your autonomous AI agent for the ZER0 builder community",
   "type": "module",
   "bin": {