Skip to content

v0.8.0 — Lite mode

Latest
Latest

Choose a tag to compare

View all tags
@hamr0 hamr0 released this 16 Jun 11:43
· 10 commits to master since this release
v0.8.0
6f45177
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

beeperbox v0.8.0 — Lite mode

Run beeperbox's MCP verb server standalone against a Beeper Desktop you already have open — no Docker, no Electron, no Xvfb. It's the same single mcp/server.js the container runs, so the 12-tool surface and serverInfo.version are identical by construction.

Two ways to run, one verb layer:

  • Container (always-on / VPS, no human at a desktop): docker compose up -d
  • Lite mode (laptop, Beeper already open): BEEPER_TOKEN=… npx beeperbox (or npx beeperbox --stdio)

Added

  • npm package beeperbox — npx beeperbox / npx beeperbox --stdio. Zero runtime dependencies; published with SLSA provenance via OIDC trusted publishing.
  • Startup preflight — a bounded /v1/accounts probe on boot logs a clear OK … N account(s) / FAIL … verdict (lite mode's substitute for the container's healthcheck). Opt out with BEEPERBOX_PREFLIGHT=0; the container image disables it (it already has a healthcheck + supervisor).
  • Single-sourced version — serverInfo.version reads from package.json, so the npm package, the container, and the MCP initialize response can't drift (unit-tested).

Fixed

  • Sent-ledger now persists on a normal host. The echo-guard ledger defaulted to a container-only /root/.config/... path that silently failed to write on a non-root host, degrading the source:"api" guard across restarts. Now a per-user XDG path ($XDG_CONFIG_HOME/beeperbox/sent-ledger.json → ~/.config/beeperbox/sent-ledger.json), parent dir auto-created. One code path for both deployments.

Security

  • ⚠️ Lite mode binds loopback by default (new MCP_BIND_ADDR, default 127.0.0.1). The server previously bound 0.0.0.0 unconditionally — safe in the container (Docker publishes the port on 127.0.0.1, the loopback publish is the boundary), but lite mode had no such layer, exposing the full tool surface (read every message, send across every network) to the LAN unauthenticated via a spoofed Host header. Found and fixed by a /security pass on the change. The container image keeps 0.0.0.0 via ENV. If you ran npx beeperbox@0.7.0, upgrade to 0.8.0 (0.7.0 is deprecated).

Changed

  • De-containerized the BEEPER_TOKEN-missing error message (transport-agnostic).

Docker: ghcr.io/hamr0/beeperbox:0.8.0 (multi-arch linux/amd64 + linux/arm64) · npm: beeperbox@0.8.0

Full notes: CHANGELOG.md

Assets 2
Loading