limweb
diff --git a/‎CHANGELOG.md‎
Lines changed: 21 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 21 additions & 0 deletions
diff --git a/‎VERSION‎
Lines changed: 1 addition & 1 deletion b/‎VERSION‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎browse/src/browser-manager.ts‎
Lines changed: 9 additions & 1 deletion b/‎browse/src/browser-manager.ts‎
Lines changed: 9 additions & 1 deletion
diff --git a/‎browse/src/config.ts‎
Lines changed: 1 addition & 1 deletion b/‎browse/src/config.ts‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎browse/src/cookie-picker-routes.ts‎
Lines changed: 7 additions & 8 deletions b/‎browse/src/cookie-picker-routes.ts‎
Lines changed: 7 additions & 8 deletions
diff --git a/‎browse/src/server.ts‎
Lines changed: 33 additions & 19 deletions b/‎browse/src/server.ts‎
Lines changed: 33 additions & 19 deletions
diff --git a/‎browse/src/sidebar-agent.ts‎
Lines changed: 35 additions & 4 deletions b/‎browse/src/sidebar-agent.ts‎
Lines changed: 35 additions & 4 deletions
diff --git a/‎browse/src/url-validation.ts‎
Lines changed: 29 additions & 5 deletions b/‎browse/src/url-validation.ts‎
Lines changed: 29 additions & 5 deletions
@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.15.7.0] - 2026-04-05 — Security Wave 1
+
+Fourteen fixes for the security audit (#783). Design server no longer binds all interfaces. Path traversal, auth bypass, CORS wildcard, world-readable files, prompt injection, and symlink race conditions all closed. Community PRs from @Gonzih and @garagon included.
+
+### Fixed
+
+- **Design server binds localhost only.** Previously bound 0.0.0.0, meaning anyone on your WiFi could access mockups and hit all endpoints. Now 127.0.0.1 only, matching the browse server.
+- **Path traversal on /api/reload blocked.** Could previously read any file on disk (including ~/.ssh/id_rsa) by passing an arbitrary path in the JSON body. Now validates paths stay within cwd or tmpdir.
+- **Auth gate on /inspector/events.** SSE endpoint was unauthenticated while /activity/stream required tokens. Now both require the same Bearer or ?token= check.
+- **Prompt injection defense in design feedback.** User feedback is now wrapped in XML trust boundary markers with tag escaping. Accumulated feedback capped to last 5 iterations to limit poisoning.
+- **File and directory permissions hardened.** All ~/.gstack/ dirs now created with mode 0o700, files with 0o600. Setup script sets umask 077. Auth tokens, chat history, and browser logs no longer world-readable.
+- **TOCTOU race in setup symlink creation.** Removed existence check before mkdir -p (idempotent). Validates target isn't a symlink before creating the link.
+- **CORS wildcard removed.** Browse server no longer sends Access-Control-Allow-Origin: *. Chrome extension uses manifest host_permissions and isn't affected. Blocks malicious websites from making cross-origin requests.
+- **Cookie picker auth mandatory.** Previously skipped auth when authToken was undefined. Now always requires Bearer token for all data/action routes.
+- **/health token gated on extension Origin.** Auth token only returned when request comes from chrome-extension:// origin. Prevents token leak when browse server is tunneled.
+- **DNS rebinding protection checks IPv6.** AAAA records now validated alongside A records. Blocks fe80:: link-local addresses.
+- **Symlink bypass in validateOutputPath.** Real path resolved after lexical validation to catch symlinks inside safe directories.
+- **URL validation on restoreState.** Saved URLs validated before navigation to prevent state file tampering.
+- **Telemetry endpoint uses anon key.** Service role key (bypasses RLS) replaced with anon key for the public telemetry endpoint.
+- **killAgent actually kills subprocess.** Cross-process kill signaling via kill-file + polling.
+
 ## [0.15.6.2] - 2026-04-04 — Anti-Skip Review Rule
 
 Review skills now enforce that every section gets evaluated, regardless of plan type. No more "this is a strategy doc so implementation sections don't apply." If a section genuinely has nothing to flag, say so and move on, but you have to look.
 
@@ -1 +1 @@
-0.15.6.2
+0.15.7.0
@@ -822,7 +822,15 @@ export class BrowserManager {
       this.wirePageEvents(page);
 
       if (saved.url) {
-        await page.goto(saved.url, { waitUntil: 'domcontentloaded', timeout: 15000 }).catch(() => {});
+        // Validate the saved URL before navigating — the state file is user-writable and
+        // a tampered URL could navigate to cloud metadata endpoints or file:// URIs.
+        try {
+          await validateNavigationUrl(saved.url);
+          await page.goto(saved.url, { waitUntil: 'domcontentloaded', timeout: 15000 }).catch(() => {});
+        } catch {
+          // Invalid URL in saved state — skip navigation, leave blank page
+          console.log(`[browse] restoreState: skipping unsafe URL: ${saved.url}`);
+        }
       }
 
       if (saved.storage) {
 
@@ -79,7 +79,7 @@ export function resolveConfig(
  */
 export function ensureStateDir(config: BrowseConfig): void {
   try {
-    fs.mkdirSync(config.stateDir, { recursive: true });
+    fs.mkdirSync(config.stateDir, { recursive: true, mode: 0o700 });
   } catch (err: any) {
     if (err.code === 'EACCES') {
       throw new Error(`Cannot create state directory ${config.stateDir}: permission denied`);
 
@@ -81,14 +81,13 @@ export async function handleCookiePickerRoute(
     }
 
     // ─── Auth gate: all data/action routes below require Bearer token ───
-    if (authToken) {
-      const authHeader = req.headers.get('authorization');
-      if (!authHeader || authHeader !== `Bearer ${authToken}`) {
-        return new Response(JSON.stringify({ error: 'Unauthorized' }), {
-          status: 401,
-          headers: { 'Content-Type': 'application/json' },
-        });
-      }
+    // Auth is mandatory — if authToken is undefined, reject all requests
+    const authHeader = req.headers.get('authorization');
+    if (!authToken || !authHeader || authHeader !== `Bearer ${authToken}`) {
+      return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+        status: 401,
+        headers: { 'Content-Type': 'application/json' },
+      });
     }
 
     // GET /cookie-picker/browsers — list installed browsers
 
@@ -398,10 +398,10 @@ function createSession(): SidebarSession {
     lastActiveAt: new Date().toISOString(),
   };
   const sessionDir = path.join(SESSIONS_DIR, id);
-  fs.mkdirSync(sessionDir, { recursive: true });
-  fs.writeFileSync(path.join(sessionDir, 'session.json'), JSON.stringify(session, null, 2));
-  fs.writeFileSync(path.join(sessionDir, 'chat.jsonl'), '');
-  fs.writeFileSync(path.join(SESSIONS_DIR, 'active.json'), JSON.stringify({ id }));
+  fs.mkdirSync(sessionDir, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(path.join(sessionDir, 'session.json'), JSON.stringify(session, null, 2), { mode: 0o600 });
+  fs.writeFileSync(path.join(sessionDir, 'chat.jsonl'), '', { mode: 0o600 });
+  fs.writeFileSync(path.join(SESSIONS_DIR, 'active.json'), JSON.stringify({ id }), { mode: 0o600 });
   chatBuffer = [];
   chatNextId = 0;
   return session;
@@ -411,7 +411,7 @@ function saveSession(): void {
   if (!sidebarSession) return;
   sidebarSession.lastActiveAt = new Date().toISOString();
   const sessionFile = path.join(SESSIONS_DIR, sidebarSession.id, 'session.json');
-  try { fs.writeFileSync(sessionFile, JSON.stringify(sidebarSession, null, 2)); } catch (err: any) {
+  try { fs.writeFileSync(sessionFile, JSON.stringify(sidebarSession, null, 2), { mode: 0o600 }); } catch (err: any) {
     console.error('[browse] Failed to save session:', err.message);
   }
 }
@@ -558,7 +558,7 @@ function spawnClaude(userMessage: string, extensionUrl?: string | null, forTabId
     tabId: agentTabId,
   });
   try {
-    fs.mkdirSync(gstackDir, { recursive: true });
+    fs.mkdirSync(gstackDir, { recursive: true, mode: 0o700 });
     fs.appendFileSync(agentQueue, entry + '\n');
   } catch (err: any) {
     addChatEntry({ ts: new Date().toISOString(), role: 'agent', type: 'agent_error', error: `Failed to queue: ${err.message}` });
@@ -585,6 +585,13 @@ function killAgent(): void {
   agentStartTime = null;
   currentMessage = null;
   agentStatus = 'idle';
+
+  // Signal sidebar-agent.ts to kill its active claude subprocess.
+  // sidebar-agent runs in a separate non-compiled Bun process (posix_spawn
+  // limitation). It polls the kill-signal file and terminates on any write.
+  const agentQueue = process.env.SIDEBAR_QUEUE_PATH || path.join(process.env.HOME || '/tmp', '.gstack', 'sidebar-agent-queue.jsonl');
+  const killFile = path.join(path.dirname(agentQueue), 'sidebar-agent-kill');
+  try { fs.writeFileSync(killFile, String(Date.now())); } catch {}
 }
 
 // Agent health check — detect hung processes
@@ -607,7 +614,7 @@ function startAgentHealthCheck(): void {
 
 // Initialize session on startup
 function initSidebarSession(): void {
-  fs.mkdirSync(SESSIONS_DIR, { recursive: true });
+  fs.mkdirSync(SESSIONS_DIR, { recursive: true, mode: 0o700 });
   sidebarSession = loadSession();
   if (!sidebarSession) {
     sidebarSession = createSession();
@@ -1086,10 +1093,11 @@ async function start() {
           uptime: Math.floor((Date.now() - startTime) / 1000),
           tabs: browserManager.getTabCount(),
           currentUrl: browserManager.getCurrentUrl(),
-          // Auth token for extension bootstrap. Safe: /health is localhost-only.
-          // Previously served via .auth.json in extension dir, but that breaks
-          // read-only .app bundles and codesigning. Extension reads token from here.
-          token: AUTH_TOKEN,
+          // Auth token for extension bootstrap. Only returned when the request
+          // comes from a Chrome extension (Origin: chrome-extension://...).
+          // Previously served unconditionally, but that leaks the token if the
+          // server is tunneled to the internet (ngrok, SSH tunnel).
+          ...(req.headers.get('origin')?.startsWith('chrome-extension://') ? { token: AUTH_TOKEN } : {}),
           chatEnabled: true,
           agent: {
             status: agentStatus,
@@ -1222,12 +1230,12 @@ async function start() {
           const tabs = await browserManager.getTabListWithTitles();
           return new Response(JSON.stringify({ tabs }), {
             status: 200,
-            headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' },
+            headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': 'http://127.0.0.1' },
           });
         } catch (err: any) {
           return new Response(JSON.stringify({ tabs: [], error: err.message }), {
             status: 200,
-            headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' },
+            headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': 'http://127.0.0.1' },
           });
         }
       }
@@ -1246,7 +1254,7 @@ async function start() {
           browserManager.switchTab(tabId);
           return new Response(JSON.stringify({ ok: true, activeTab: tabId }), {
             status: 200,
-            headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' },
+            headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': 'http://127.0.0.1' },
           });
         } catch (err: any) {
           return new Response(JSON.stringify({ error: err.message }), { status: 400, headers: { 'Content-Type': 'application/json' } });
@@ -1268,7 +1276,7 @@ async function start() {
         const tabAgentStatus = tabId !== null ? getTabAgentStatus(tabId) : agentStatus;
         return new Response(JSON.stringify({ entries, total: chatNextId, agentStatus: tabAgentStatus, activeTabId: activeTab }), {
           status: 200,
-          headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' },
+          headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': 'http://127.0.0.1' },
         });
       }
 
@@ -1324,7 +1332,7 @@ async function start() {
         chatBuffer = [];
         chatNextId = 0;
         if (sidebarSession) {
-          try { fs.writeFileSync(path.join(SESSIONS_DIR, sidebarSession.id, 'chat.jsonl'), ''); } catch (err: any) {
+          try { fs.writeFileSync(path.join(SESSIONS_DIR, sidebarSession.id, 'chat.jsonl'), '', { mode: 0o600 }); } catch (err: any) {
             console.error('[browse] Failed to clear chat file:', err.message);
           }
         }
@@ -1549,8 +1557,14 @@ async function start() {
         });
       }
 
-      // GET /inspector/events — SSE for inspector state changes
+      // GET /inspector/events — SSE for inspector state changes (auth required)
       if (url.pathname === '/inspector/events' && req.method === 'GET') {
+        const streamToken = url.searchParams.get('token');
+        if (!validateAuth(req) && streamToken !== AUTH_TOKEN) {
+          return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+            status: 401, headers: { 'Content-Type': 'application/json' },
+          });
+        }
         const encoder = new TextEncoder();
         const stream = new ReadableStream({
           start(controller) {
@@ -1680,8 +1694,8 @@ start().catch((err) => {
   // stderr because the server is launched with detached: true, stdio: 'ignore'.
   try {
     const errorLogPath = path.join(config.stateDir, 'browse-startup-error.log');
-    fs.mkdirSync(config.stateDir, { recursive: true });
-    fs.writeFileSync(errorLogPath, `${new Date().toISOString()} ${err.message}\n${err.stack || ''}\n`);
+    fs.mkdirSync(config.stateDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(errorLogPath, `${new Date().toISOString()} ${err.message}\n${err.stack || ''}\n`, { mode: 0o600 });
   } catch {
     // stateDir may not exist — nothing more we can do
   }
 
@@ -14,6 +14,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 
 const QUEUE = process.env.SIDEBAR_QUEUE_PATH || path.join(process.env.HOME || '/tmp', '.gstack', 'sidebar-agent-queue.jsonl');
+const KILL_FILE = path.join(path.dirname(QUEUE), 'sidebar-agent-kill');
 const SERVER_PORT = parseInt(process.env.BROWSE_SERVER_PORT || '34567', 10);
 const SERVER_URL = `http://127.0.0.1:${SERVER_PORT}`;
 const POLL_MS = 200;  // 200ms poll — keeps time-to-first-token low
@@ -23,6 +24,10 @@ let lastLine = 0;
 let authToken: string | null = null;
 // Per-tab processing — each tab can run its own agent concurrently
 const processingTabs = new Set<number>();
+// Active claude subprocesses — keyed by tabId for targeted kill
+const activeProcs = new Map<number, ReturnType<typeof spawn>>();
+// Kill-file timestamp last seen — avoids double-kill on same write
+let lastKillTs = 0;
 
 // ─── File drop relay ──────────────────────────────────────────
 
@@ -44,7 +49,7 @@ function writeToInbox(message: string, pageUrl?: string, sessionId?: string): vo
   }
 
   const inboxDir = path.join(gitRoot, '.context', 'sidebar-inbox');
-  fs.mkdirSync(inboxDir, { recursive: true });
+  fs.mkdirSync(inboxDir, { recursive: true, mode: 0o700 });
 
   const now = new Date();
   const timestamp = now.toISOString().replace(/:/g, '-');
@@ -60,7 +65,7 @@ function writeToInbox(message: string, pageUrl?: string, sessionId?: string): vo
     sidebarSessionId: sessionId || 'unknown',
   };
 
-  fs.writeFileSync(tmpFile, JSON.stringify(inboxMessage, null, 2));
+  fs.writeFileSync(tmpFile, JSON.stringify(inboxMessage, null, 2), { mode: 0o600 });
   fs.renameSync(tmpFile, finalFile);
   console.log(`[sidebar-agent] Wrote inbox message: ${filename}`);
 }
@@ -263,6 +268,9 @@ async function askClaude(queueEntry: any): Promise<void> {
       },
     });
 
+    // Track active procs so kill-file polling can terminate them
+    activeProcs.set(tid, proc);
+
     proc.stdin.end();
 
     let buffer = '';
@@ -285,6 +293,7 @@ async function askClaude(queueEntry: any): Promise<void> {
     });
 
     proc.on('close', (code) => {
+      activeProcs.delete(tid);
       if (buffer.trim()) {
         try { handleStreamEvent(JSON.parse(buffer), tid); } catch (err: any) {
           console.error(`[sidebar-agent] Tab ${tid}: Failed to parse final buffer:`, buffer.slice(0, 100), err.message);
@@ -381,10 +390,31 @@ async function poll() {
 
 // ─── Main ────────────────────────────────────────────────────────
 
+function pollKillFile(): void {
+  try {
+    const stat = fs.statSync(KILL_FILE);
+    const mtime = stat.mtimeMs;
+    if (mtime > lastKillTs) {
+      lastKillTs = mtime;
+      if (activeProcs.size > 0) {
+        console.log(`[sidebar-agent] Kill signal received — terminating ${activeProcs.size} active agent(s)`);
+        for (const [tid, proc] of activeProcs) {
+          try { proc.kill('SIGTERM'); } catch {}
+          setTimeout(() => { try { proc.kill('SIGKILL'); } catch {} }, 2000);
+          processingTabs.delete(tid);
+        }
+        activeProcs.clear();
+      }
+    }
+  } catch {
+    // Kill file doesn't exist yet — normal state
+  }
+}
+
 async function main() {
   const dir = path.dirname(QUEUE);
-  fs.mkdirSync(dir, { recursive: true });
-  if (!fs.existsSync(QUEUE)) fs.writeFileSync(QUEUE, '');
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (!fs.existsSync(QUEUE)) fs.writeFileSync(QUEUE, '', { mode: 0o600 });
 
   lastLine = countLines();
   await refreshToken();
@@ -394,6 +424,7 @@ async function main() {
   console.log(`[sidebar-agent] Browse binary: ${B}`);
 
   setInterval(poll, POLL_MS);
+  setInterval(pollKillFile, POLL_MS);
 }
 
 main().catch(console.error);
@@ -4,8 +4,10 @@
  */
 
 const BLOCKED_METADATA_HOSTS = new Set([
-  '169.254.169.254',  // AWS/GCP/Azure instance metadata
+  '169.254.169.254',  // AWS/GCP/Azure instance metadata (IPv4 link-local)
+  'fe80::1',          // IPv6 link-local — common metadata endpoint alias
   'fd00::',           // IPv6 unique local (metadata in some cloud setups)
+  '::ffff:169.254.169.254', // IPv4-mapped IPv6 form of the metadata IP
   'metadata.google.internal', // GCP metadata
   'metadata.azure.internal',  // Azure IMDS
 ]);
@@ -47,15 +49,37 @@ function isMetadataIp(hostname: string): boolean {
 /**
  * Resolve a hostname to its IP addresses and check if any resolve to blocked metadata IPs.
  * Mitigates DNS rebinding: even if the hostname looks safe, the resolved IP might not be.
+ *
+ * Checks both A (IPv4) and AAAA (IPv6) records — an attacker can use AAAA-only DNS to
+ * bypass IPv4-only checks. Each record family is tried independently; failure of one
+ * (e.g. no AAAA records exist) is not treated as a rebinding risk.
  */
 async function resolvesToBlockedIp(hostname: string): Promise<boolean> {
   try {
     const dns = await import('node:dns');
-    const { resolve4 } = dns.promises;
-    const addresses = await resolve4(hostname);
-    return addresses.some(addr => BLOCKED_METADATA_HOSTS.has(addr));
+    const { resolve4, resolve6 } = dns.promises;
+
+    // Check IPv4 A records
+    const v4Check = resolve4(hostname).then(
+      (addresses) => addresses.some(addr => BLOCKED_METADATA_HOSTS.has(addr)),
+      () => false, // ENODATA / ENOTFOUND — no A records, not a risk
+    );
+
+    // Check IPv6 AAAA records — the gap that issue #668 identified
+    const v6Check = resolve6(hostname).then(
+      (addresses) => addresses.some(addr => {
+        const normalized = addr.toLowerCase();
+        return BLOCKED_METADATA_HOSTS.has(normalized) ||
+          // fe80::/10 is link-local — always block (covers all fe80:: addresses)
+          normalized.startsWith('fe80:');
+      }),
+      () => false, // ENODATA / ENOTFOUND — no AAAA records, not a risk
+    );
+
+    const [v4Blocked, v6Blocked] = await Promise.all([v4Check, v6Check]);
+    return v4Blocked || v6Blocked;
   } catch {
-    // DNS resolution failed — not a rebinding risk
+    // Unexpected error — fail open (don't block navigation on DNS infrastructure failure)
     return false;
   }
 }