security: server-side gate — password moves to GATE_PASSWORD env (#6)

The password was hardcoded in app.js (const === '1234') — anyone
reading the asset had the secret, and the check was client-side only,
so the WebSocket was reachable without solving the gate at all.

Now:
- agent-bridge reads GATE_PASSWORD from env; unset = open bridge
  (loopback/local use, previous behavior)
- POST /auth validates the password and returns a per-run random
  token; the secret exists only in the process env
- WebSocket upgrades must carry ?token= when a password is set;
  rejects with close 1008
- app.js: unlock() exchanges the password via /auth, stores the
  token, attaches it to the WS URL; a 1008 close clears the token
  and re-shows the gate (no reconnect loop)
- '1234' and the chat-pass localStorage flag are gone from the
  codebase entirely

Author: gosunuts

frontend/agent-bridge.ts

@@ -127,14 +127,29 @@ const html = await Bun.file(new URL("./index.html", import.meta.url)).text();
 const css = await Bun.file(new URL("./style.css", import.meta.url)).text();
 const js = await Bun.file(new URL("./app.js", import.meta.url)).text();
 
+const GATE_PASSWORD = process.env.GATE_PASSWORD || "";
+const RUN_TOKEN = crypto.randomUUID();
 Bun.serve({
   port: PORT,
   hostname: "127.0.0.1",
   async fetch(req, server) {
-    // WebSocket upgrade first
-    if (server.upgrade(req)) return;
+    const url = new URL(req.url);
+    const path = url.pathname;
+
+    // Server-side gate: the password lives only in this process's env.
+    // POST /auth exchanges it for a per-run token; WS upgrades must
+    // carry that token when GATE_PASSWORD is set. No password
+    // configured → bridge is open (loopback/local use).
+    if (path === "/auth") {
+      const body = await req.json().catch(() => ({ password: "" }));
+      const ok = !GATE_PASSWORD || body.password === GATE_PASSWORD;
+      if (ok) return Response.json({ ok: true, token: RUN_TOKEN });
+      return Response.json({ ok: false }, { status: 401 });
+    }
+
+    // WebSocket upgrade — token attached as ?token=
+    if (server.upgrade(req, { data: { token: url.searchParams.get("token") } })) return;
 
-    const path = new URL(req.url).pathname;
     if (path === "/" || path === "/index.html") {
       return new Response(html, { headers: { "Content-Type": "text/html; charset=utf-8" } });
     }
@@ -152,9 +167,13 @@ Bun.serve({
 
   websocket: {
     open(ws: ClientWebSocket) {
+      // Gate: reject upgrades without the run token (close 1008 → the
+      // client shows the password prompt instead of reconnect-looping)
+      if (GATE_PASSWORD && ws.data?.token !== RUN_TOKEN) {
+        ws.close(1008, "unauthorized");
+        return;
+      }
       clients.add(ws);
-      ws.activeSession = null;
-      console.log(`[bridge] client connected (${clients.size})`);
 
       // Reconnect (page refresh) → reattach to the most recent session;
       // only create one when none exist.

frontend/app.js

@@ -92,19 +92,35 @@ function saveNick(v) {
   localStorage.setItem('chat-nick', nick);
 }
 
-// ── 4. Password gate (R3) ────────────────────────────────────────────
-
-function unlock() {
-  if (gateInput.value === '1234') {
-    gateEl.style.display = 'none';
-    localStorage.setItem('chat-pass', '1');
-    input.focus();
-  } else {
-    gateInput.value = '';
-    gateInput.placeholder = 'wrong';
+// ── 4. Password gate (R3) — server-side ─────────────────────────────
+// No password lives in this file: POST /auth exchanges it for a per-run
+// token which rides the WS URL. A 1008 close = token rejected → show
+// the gate again instead of reconnect-looping.
+
+async function unlock() {
+  gateInput.disabled = true;
+  try {
+    const res = await fetch('/auth', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ password: gateInput.value }),
+    });
+    const data = await res.json().catch(() => ({ ok: false }));
+    if (data.ok && data.token) {
+      localStorage.setItem('chat-token', data.token);
+      gateEl.style.display = 'none';
+      input.focus();
+      connect();
+    } else {
+      gateInput.value = '';
+      gateInput.placeholder = 'wrong';
+    }
+  } catch {
+    gateInput.placeholder = 'server unreachable';
+  } finally {
+    gateInput.disabled = false;
   }
 }
-if (localStorage.getItem('chat-pass') === '1') gateEl.style.display = 'none';
 
 // ── 5. Sidebar / sessions (R2) ───────────────────────────────────────
 
@@ -748,12 +764,14 @@ function handleEvent(msg) {
 
 function connect() {
   const proto = location.protocol === 'https:' ? 'wss:' : 'ws:';
-  ws = new WebSocket(proto + '//' + location.host);
+  const token = localStorage.getItem('chat-token');
+  ws = new WebSocket(proto + '//' + location.host + (token ? '?token=' + encodeURIComponent(token) : ''));
 
   ws.onopen = () => {
     dot.classList.add('on');
     input.disabled = false;
     sendBtn.disabled = false;
+    gateEl.style.display = 'none';  // connected → authenticated (or no gate)
     clearTimeout(reconnectTimer);
     // The bridge reattaches refreshes to the latest session (R2); on a
     // first-ever connect it auto-creates one.
@@ -764,10 +782,17 @@ function connect() {
     }
   };
 
-  ws.onclose = () => {
+  ws.onclose = (e) => {
     dot.classList.remove('on');
     input.disabled = true;
     sendBtn.disabled = true;
+    if (e.code === 1008) {
+      // Token rejected — show the gate; no reconnect loop
+      localStorage.removeItem('chat-token');
+      gateEl.style.display = 'flex';
+      gateInput.focus();
+      return;
+    }
     reconnectTimer = setTimeout(connect, 2000);
   };