audit engine v2 + xAI integration + agent factory (v2.10.14 → v2.10.39)

mobile-ios/Models/AppSettings.swift

@@ -1,9 +1,47 @@
 // KCodeMobile - Persistent settings
-// Server URL, session ID, model preferences — persisted to UserDefaults
+// Non-sensitive prefs (serverURL, model, cwd) use UserDefaults.
+// Sensitive auth tokens (sessionId) use Keychain via Security framework.
 
 import Foundation
+import Security
 import SwiftUI
 
+private enum KeychainHelper {
+    static func save(key: String, value: String) {
+        guard let data = value.data(using: .utf8) else { return }
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrAccount as String: key,
+        ]
+        SecItemDelete(query as CFDictionary)
+        var add = query
+        add[kSecValueData as String] = data
+        add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
+        SecItemAdd(add as CFDictionary, nil)
+    }
+
+    static func load(key: String) -> String? {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrAccount as String: key,
+            kSecReturnData as String: true,
+            kSecMatchLimit as String: kSecMatchLimitOne,
+        ]
+        var result: AnyObject?
+        guard SecItemCopyMatching(query as CFDictionary, &result) == errSecSuccess,
+              let data = result as? Data else { return nil }
+        return String(data: data, encoding: .utf8)
+    }
+
+    static func delete(key: String) {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrAccount as String: key,
+        ]
+        SecItemDelete(query as CFDictionary)
+    }
+}
+
 class AppSettings: ObservableObject {
     @Published var serverURL: String {
         didSet { UserDefaults.standard.set(serverURL, forKey: "serverURL") }
@@ -18,14 +56,26 @@ class AppSettings: ObservableObject {
     }
 
     @Published var sessionId: String? {
-        didSet { UserDefaults.standard.set(sessionId, forKey: "sessionId") }
+        didSet {
+            if let id = sessionId {
+                KeychainHelper.save(key: "sessionId", value: id)
+            } else {
+                KeychainHelper.delete(key: "sessionId")
+            }
+        }
     }
 
     init() {
         self.serverURL = UserDefaults.standard.string(forKey: "serverURL") ?? "http://localhost:10100"
         self.model = UserDefaults.standard.string(forKey: "model") ?? "claude-opus-4-6"
         self.cwd = UserDefaults.standard.string(forKey: "cwd") ?? ""
-        self.sessionId = UserDefaults.standard.string(forKey: "sessionId")
+        self.sessionId = KeychainHelper.load(key: "sessionId")
+        // Migrate: if sessionId was previously in UserDefaults, move it
+        // to Keychain and remove the plaintext copy.
+        if sessionId == nil, let legacy = UserDefaults.standard.string(forKey: "sessionId") {
+            self.sessionId = legacy
+            UserDefaults.standard.removeObject(forKey: "sessionId")
+        }
     }
 
     func resetSession() {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "kcode",
-  "version": "2.10.13",
+  "version": "2.10.39",
   "description": "AI-powered coding assistant for the terminal - by Astrolexis",
   "author": "Astrolexis",
   "module": "src/index.ts",

src/bridge/websocket-server.ts

@@ -1,8 +1,25 @@
 // KCode Bridge/Daemon Mode - WebSocket Server
 // Bun-native WebSocket server for bidirectional daemon communication.
 
+import { timingSafeEqual } from "node:crypto";
 import type { Server, ServerWebSocket } from "bun";
 import { log } from "../core/logger";
+
+/**
+ * Constant-time comparison of two auth tokens. Prevents timing
+ * side-channel attacks that could recover a token character by
+ * character. Both inputs are normalized to equal-length Buffers
+ * before comparison, since timingSafeEqual throws on length mismatch.
+ */
+function timingSafeTokenEqual(supplied: string, expected: string): boolean {
+  const a = Buffer.from(supplied);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) {
+    timingSafeEqual(b, b);
+    return false;
+  }
+  return timingSafeEqual(a, b);
+}
 import type { PermissionBridge } from "./permission-bridge";
 import { createMessage, isClientMessageType, parseMessage, serializeMessage } from "./protocol";
 import type { SessionManager } from "./session-manager";
@@ -102,7 +119,7 @@ export class BridgeWebSocketServer {
             ? authHeader.slice(7)
             : (url.searchParams.get("token") ?? "");
 
-          if (token !== self.token) {
+          if (!timingSafeTokenEqual(token, self.token)) {
             return new Response("Unauthorized", { status: 401 });
           }