iceBear67andClaude Opus 5
5eec1940be
/hook/record and /hook/approve accepted anything that reached the port. That is not "loopback only": `tailscale serve` proxies tailnet traffic to 127.0.0.1, so anyone who could reach the tunnel could forge timeline events and answer approval prompts. Both endpoints now require a 32-byte secret from $GLANCE_HOME/hook.secret (0600, created once, never rotated so nothing in flight is 403'd mid-session), compared in constant time before the body is read, as an x-glance-hook header or a ?k= parameter. Requests carrying x-forwarded-* are refused outright: a local hook process never sends them and a tunnelled caller always does. The check applies to /hook/* only, so the dashboard is unaffected. While wiring that up: the 13 passive `type: "http"` hooks could never have worked. Grok Build's http runner rejects every scheme but https, then resolves the host and blocks private/link-local/CGNAT addresses (validate_hook_url + is_blocked_ip), so neither loopback-over-http nor *.ts.net (100.64/10) can be a hook target - and it sends no header but Content-Type, so such a hook could not authenticate anyway. They were failing validation silently on every event. All of them are now command hooks running bin/glance-record.mjs, which costs a Node start and can present the secret. hooks.json is generated from hooks/hooks.template.json by scripts/gen-hooks.mjs (npm run build, glance sync-hooks). It creates the secret, derives the approval hook's timeout from approval.timeoutMs instead of hand-copying 125, and refuses to write a hook that cannot fire: bad type, non-positive timeout, non-https http URL, missing bin/ script, or a leftover placeholder. A template that embeds the token makes the output 0600 with a warning. Fail-open is unchanged: a missing, stale or rejected secret degrades to "no telemetry", and glance-approve.mjs still allows on every error path. glance status warns when the on-disk secret no longer matches the daemon's. Validated with the e2e suite (190 checks, including no-token/wrong-token/ same-length-token 403s, ?k= acceptance, x-forwarded-* refusal, and the recorder's fail-open paths) and a clean npm run build. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
39 lines
1.1 KiB
JSON
39 lines
1.1 KiB
JSON
{
|
|
"name": "grok-glance",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "Glance at what Grok Build is doing, from your phone, behind a passkey.",
|
|
"engines": {
|
|
"node": ">=20"
|
|
},
|
|
"scripts": {
|
|
"build": "npm run build:server && npm run build:web && npm run build:hooks",
|
|
"build:server": "tsc -p tsconfig.server.json",
|
|
"build:web": "tsc -p tsconfig.web.json && vite build",
|
|
"build:hooks": "node scripts/gen-hooks.mjs",
|
|
"dev": "vite",
|
|
"start": "node dist/server/index.js",
|
|
"glance": "node bin/glance"
|
|
},
|
|
"dependencies": {
|
|
"@heroui/react": "3.2.4",
|
|
"@heroui/styles": "3.2.4",
|
|
"@simplewebauthn/browser": "13.3.0",
|
|
"@simplewebauthn/server": "13.3.2",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/vite": "4.3.1",
|
|
"@types/node": "22.12.0",
|
|
"@types/react": "^19.0.0",
|
|
"@types/react-dom": "^19.0.0",
|
|
"@vitejs/plugin-react": "6.0.2",
|
|
"tailwind-variants": "3.3.0",
|
|
"tailwindcss": "4.3.1",
|
|
"typescript": "5.6.3",
|
|
"vite": "8.0.16"
|
|
}
|
|
}
|