Allow xterm runtime styles under CSP

Author: murrellb

README.md

@@ -18,15 +18,15 @@ The same release also contains fully self-contained installers for direct or off
 
 | Machine | Release asset |
 | --- | --- |
-| Linux x86-64 | `WebSpider_Install_0.4.6_linux_x64.run` |
-| Linux ARM64 | `WebSpider_Install_0.4.6_linux_arm64.run` |
-| macOS Intel | `WebSpider_Install_0.4.6_macos_x64.run` |
-| macOS Apple silicon | `WebSpider_Install_0.4.6_macos_arm64.run` |
+| Linux x86-64 | `WebSpider_Install_0.4.7_linux_x64.run` |
+| Linux ARM64 | `WebSpider_Install_0.4.7_linux_arm64.run` |
+| macOS Intel | `WebSpider_Install_0.4.7_macos_x64.run` |
+| macOS Apple silicon | `WebSpider_Install_0.4.7_macos_arm64.run` |
 
 Run the downloaded asset directly through the system shell:
 
 ```bash
-sh ~/Downloads/WebSpider_Install_0.4.6_linux_x64.run --workspace /path/to/project
+sh ~/Downloads/WebSpider_Install_0.4.7_linux_x64.run --workspace /path/to/project
 ```
 
 No separate runtime or package-manager setup is part of either user workflow.
@@ -75,7 +75,7 @@ The repository owns the build recipe; GitHub Releases own the binaries. `.github
 - `darwin-x64` on `macos-15-intel`;
 - `darwin-arm64` on `macos-15`.
 
-Pull requests, `main` pushes, and manual runs produce short-lived Actions artifacts after a clean-install smoke test. A semantic version tag such as `v0.4.6` additionally:
+Pull requests, `main` pushes, and manual runs produce short-lived Actions artifacts after a clean-install smoke test. A semantic version tag such as `v0.4.7` additionally:
 
 1. requires the tag to equal the version in `package.json`;
 2. gathers exactly four native installers;
@@ -86,8 +86,8 @@ Pull requests, `main` pushes, and manual runs produce short-lived Actions artifa
 Create a release by pushing its annotated tag:
 
 ```bash
-git tag -a v0.4.6 -m "WebSpider 0.4.6"
-git push origin v0.4.6
+git tag -a v0.4.7 -m "WebSpider 0.4.7"
+git push origin v0.4.7
 ```
 
 For a native development build on the current machine:

package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspider-fabric",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "private": true,
   "description": "Distributed, persistent LLM-agent orchestration control plane",
   "type": "module",

src/cli.js

@@ -329,7 +329,7 @@ function BunLikeSpawn(executable) {
 }
 
 function help() {
-  process.stdout.write(`WebSpider 0.4.6\n\n`);
+  process.stdout.write(`WebSpider 0.4.7\n\n`);
   process.stdout.write(`Usage:\n`);
   process.stdout.write(`  webspider up [--listen 127.0.0.1:7340] [--workspace PATH] [--agent-command PATH] [--agent-args JSON]\n`);
   process.stdout.write(`  webspider hub [--listen 127.0.0.1:7340]\n`);

src/hub/hub.js

@@ -187,7 +187,7 @@ export class Hub {
   #registerRoutes() {
     const route = (method, pattern, handler, options) => this.router.add(method, pattern, handler, options);
 
-    route('GET', '/healthz', async () => ({ status: 'ok', version: '0.4.6', time: nowISO() }), { auth: false, csrf: false });
+    route('GET', '/healthz', async () => ({ status: 'ok', version: '0.4.7', time: nowISO() }), { auth: false, csrf: false });
     route('POST', '/api/v1/auth/login', async (ctx) => {
       const body = await readJSON(ctx.request, 16_384);
       invariant(typeof body.token === 'string' && secureEqual(body.token, this.ownerToken), 'WS_AUTH_REQUIRED', 'Owner token is invalid.', 401);
@@ -687,7 +687,7 @@ export class Hub {
     response.setHeader('referrer-policy', 'no-referrer');
     response.setHeader('permissions-policy', 'camera=(), microphone=(), geolocation=()');
     response.setHeader('cross-origin-resource-policy', 'same-origin');
-    response.setHeader('content-security-policy', "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; connect-src 'self' ws: wss:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'");
+    response.setHeader('content-security-policy', "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self' ws: wss:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'");
   }
 
   #serveStatic(pathname, response) {

src/transport/websocket.js

@@ -37,7 +37,13 @@ export class WebSocketConnection extends EventEmitter {
         this.emit('close');
       }
     });
-    this.socket.on('error', (error) => this.emit('error', error));
+    this.socket.on('error', (error) => {
+      if (this.listenerCount('error') > 0) this.emit('error', error);
+      if (!this.closed) {
+        this.closed = true;
+        this.emit('close');
+      }
+    });
     if (head.length) this.#consume(head);
   }
 

test/integration.test.js

@@ -210,7 +210,11 @@ test('hub and outbound node provide a root-confined end-to-end API', async (t) =
 
   const portal = await fetch(listening.url);
   assert.equal(portal.status, 200);
-  assert.match(portal.headers.get('content-security-policy'), /object-src 'none'/);
+  const contentSecurityPolicy = portal.headers.get('content-security-policy');
+  assert.match(contentSecurityPolicy, /object-src 'none'/);
+  assert.match(contentSecurityPolicy, /style-src 'self' 'unsafe-inline'/);
+  assert.match(contentSecurityPolicy, /script-src 'self';/);
+  assert.doesNotMatch(contentSecurityPolicy, /script-src[^;]*'unsafe-inline'/);
   assert.match(await portal.text(), /WebSpider/);
   const markdownModule = await fetch(`${listening.url}/markdown.js`);
   assert.equal(markdownModule.status, 200);

test/websocket.test.js

@@ -0,0 +1,19 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { EventEmitter } from 'node:events';
+import { WebSocketConnection } from '../src/transport/websocket.js';
+
+class FakeSocket extends EventEmitter {
+  setNoDelay() {}
+  write() { return true; }
+  end() {}
+}
+
+test('an abruptly disconnected browser cannot crash the hub', () => {
+  const socket = new FakeSocket();
+  const connection = new WebSocketConnection(socket);
+  let closed = false;
+  connection.on('close', () => { closed = true; });
+  assert.doesNotThrow(() => socket.emit('error', Object.assign(new Error('reset'), { code: 'ECONNRESET' })));
+  assert.equal(closed, true);
+});