staging <- dev

.github/workflows/deploy-app-walrus.yml

@@ -63,6 +63,8 @@ jobs:
           VITE_MEMWAL_PACKAGE_ID: ${{ vars.VITE_MEMWAL_PACKAGE_ID }}
           VITE_MEMWAL_REGISTRY_ID: ${{ vars.VITE_MEMWAL_REGISTRY_ID }}
           VITE_SEAL_KEY_SERVERS: ${{ vars.VITE_SEAL_KEY_SERVERS }}
+          VITE_ENOKI_API_KEY: ${{ vars.VITE_ENOKI_API_KEY }}
+          VITE_GOOGLE_CLIENT_ID: ${{ vars.VITE_GOOGLE_CLIENT_ID }}
           VITE_DOCS_URL: ${{ vars.VITE_DOCS_URL }}
           VITE_DEMO_URLS: ${{ vars.VITE_DEMO_URLS }}
 

.github/workflows/release-sdk.yml

@@ -32,13 +32,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '24'
           cache: pnpm
           registry-url: 'https://registry.npmjs.org'
 
-      - name: Upgrade npm for OIDC Trusted Publishing
-        run: npm install -g npm@latest
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 

apps/app/src/App.tsx

@@ -5,12 +5,13 @@
  * Flow: Landing → Sign in with Google (Enoki) → Setup Wizard → Dashboard
  */
 
-import { useEffect, useState, useCallback, createContext, useContext } from 'react'
+import { useEffect, useState, useCallback, useRef, createContext, useContext } from 'react'
 import {
   createNetworkConfig,
   SuiClientProvider,
   WalletProvider,
   useCurrentAccount,
+  useDisconnectWallet,
   useSuiClientContext,
 } from '@mysten/dapp-kit'
 import { isEnokiNetwork, registerEnokiWallets } from '@mysten/enoki'
@@ -39,7 +40,7 @@ const { networkConfig } = createNetworkConfig({
 const queryClient = new QueryClient()
 
 // ============================================================
-// Delegate Key Context (stored in localStorage)
+// Delegate Key Context (stored in sessionStorage — cleared on tab close, never persists across sessions)
 // ============================================================
 
 interface DelegateKeyState {
@@ -58,6 +59,12 @@ interface DelegateKeyContextType extends DelegateKeyState {
 
 const DelegateKeyContext = createContext<DelegateKeyContextType | null>(null)
 
+// LOW-32: tunable idle-timeout. 15 minutes by default. Exported so callers/tests can read it.
+export const INACTIVITY_TIMEOUT_MS = 15 * 60 * 1000
+
+// Debounce interval for activity events to avoid excessive timer resets.
+const ACTIVITY_DEBOUNCE_MS = 1000
+
 // eslint-disable-next-line react-refresh/only-export-components
 export function useDelegateKey() {
   const ctx = useContext(DelegateKeyContext)
@@ -67,7 +74,7 @@ export function useDelegateKey() {
 
 function DelegateKeyProvider({ children }: { children: React.ReactNode }) {
   const [state, setState] = useState<DelegateKeyState>(() => {
-    const saved = localStorage.getItem('memwal_delegate')
+    const saved = sessionStorage.getItem('memwal_delegate')
     if (saved) {
       try { return JSON.parse(saved) } catch { /* ignore */ }
     }
@@ -76,15 +83,77 @@ function DelegateKeyProvider({ children }: { children: React.ReactNode }) {
 
   const setDelegateKeys = useCallback((privateKey: string, publicKey: string, accountId: string) => {
     const next = { delegateKey: privateKey, delegatePublicKey: publicKey, accountObjectId: accountId }
-    localStorage.setItem('memwal_delegate', JSON.stringify(next))
+    sessionStorage.setItem('memwal_delegate', JSON.stringify(next))
     setState(next)
   }, [])
 
   const clearDelegateKeys = useCallback(() => {
-    localStorage.removeItem('memwal_delegate')
-    setState({ delegateKey: null, delegatePublicKey: null, accountObjectId: null })
+    // Best-effort zeroization: overwrite the private-key string reference before nulling.
+    // JS strings are immutable so true wipe is impossible, but we at least drop the last
+    // live reference held by this provider.
+    setState((prev) => {
+      if (prev.delegateKey) {
+        // Reassign to a placeholder of same length to encourage GC of the original buffer.
+        // (best-effort — V8 may still retain the interned string)
+        void prev.delegateKey.replace(/./g, '\0')
+      }
+      return { delegateKey: null, delegatePublicKey: null, accountObjectId: null }
+    })
+    sessionStorage.removeItem('memwal_delegate')
   }, [])
 
+  // ============================================================
+  // LOW-32: Idle-timeout — wipe in-memory key material and disconnect after inactivity.
+  // ============================================================
+  const { mutateAsync: disconnect } = useDisconnectWallet()
+  const hasKey = state.delegateKey !== null
+  const timerRef = useRef<number | null>(null)
+  const lastResetRef = useRef<number>(0)
+
+  useEffect(() => {
+    if (!hasKey) return
+
+    const triggerWipe = () => {
+      clearDelegateKeys()
+      // Fire-and-forget disconnect; redirect to landing regardless.
+      Promise.resolve(disconnect()).catch(() => { /* ignore */ })
+      try {
+        if (window.location.pathname !== '/') {
+          window.location.assign('/')
+        }
+      } catch { /* ignore */ }
+    }
+
+    const scheduleTimer = () => {
+      if (timerRef.current !== null) {
+        window.clearTimeout(timerRef.current)
+      }
+      timerRef.current = window.setTimeout(triggerWipe, INACTIVITY_TIMEOUT_MS)
+    }
+
+    const onActivity = () => {
+      const now = Date.now()
+      if (now - lastResetRef.current < ACTIVITY_DEBOUNCE_MS) return
+      lastResetRef.current = now
+      scheduleTimer()
+    }
+
+    // Start timer on mount.
+    scheduleTimer()
+
+    const events: Array<keyof WindowEventMap> = ['mousemove', 'keydown', 'click', 'scroll', 'touchstart']
+    const opts: AddEventListenerOptions = { passive: true }
+    events.forEach((ev) => window.addEventListener(ev, onActivity, opts))
+
+    return () => {
+      events.forEach((ev) => window.removeEventListener(ev, onActivity, opts))
+      if (timerRef.current !== null) {
+        window.clearTimeout(timerRef.current)
+        timerRef.current = null
+      }
+    }
+  }, [hasKey, clearDelegateKeys, disconnect])
+
   return (
     <DelegateKeyContext.Provider value={{ ...state, setDelegateKeys, clearDelegateKeys }}>
       {children}

apps/app/src/pages/Dashboard.tsx

@@ -129,8 +129,29 @@ export default function Dashboard() {
     // Generate + add a new delegate key (via SDK)
     // ============================================================
 
+    // LOW-31: sanitize a key label — strip HTML special chars and control characters
+    const sanitizeLabel = (raw: string): string =>
+        raw
+            // Strip HTML special characters
+            .replace(/[<>&"'/]/g, '')
+            // Strip C0/C1 control characters (U+0000–U+001F, U+007F–U+009F)
+            .replace(/[\x00-\x1F\x7F-\x9F]/g, '')
+            .trim()
+
     const handleAddKey = useCallback(async () => {
         if (!walletSigner) return
+
+        // LOW-31: validate label before submitting on-chain
+        const trimmedLabel = sanitizeLabel(newKeyLabel)
+        if (!trimmedLabel) {
+            setKeyError('key label cannot be empty')
+            return
+        }
+        if (trimmedLabel.length > 64) {
+            setKeyError('key label must be 64 characters or fewer')
+            return
+        }
+
         setAddingKey(true)
         setKeyError('')
         setNewPrivateKey(null)
@@ -143,7 +164,7 @@ export default function Dashboard() {
                 packageId: config.memwalPackageId,
                 accountId: accountObjectId!,
                 publicKey: delegate.publicKey,
-                label: newKeyLabel || 'New Key',
+                label: trimmedLabel,
                 walletSigner,
                 suiClient,
                 suiNetwork: config.suiNetwork,
@@ -208,11 +229,16 @@ export default function Dashboard() {
     // SDK code snippets
     // ============================================================
 
+    // LOW-30: Never render any portion (prefix/suffix) of the real private key
+    // in DOM / copyable snippets. Use a static placeholder instead.
+    const PRIVATE_KEY_PLACEHOLDER = '<YOUR_PRIVATE_KEY>'
+    const ACCOUNT_ID_PLACEHOLDER = '<YOUR_ACCOUNT_ID>'
+
     const sdkSnippet = `import { MemWal } from "@mysten-incubation/memwal"
 
 const memwal = MemWal.create({
-  key: "${delegateKey?.slice(0, 8)}...${delegateKey?.slice(-8)}",
-  accountId: "${accountObjectId?.slice(0, 10)}...",
+  key: "${PRIVATE_KEY_PLACEHOLDER}",
+  accountId: "${accountObjectId ?? ACCOUNT_ID_PLACEHOLDER}",
   serverUrl: "${config.memwalServerUrl}",
 })
 
@@ -228,8 +254,8 @@ import { withMemWal } from "@mysten-incubation/memwal/ai"
 import { openai } from "@ai-sdk/openai"
 
 const model = withMemWal(openai("gpt-4o"), {
-  key: "${delegateKey?.slice(0, 8)}...${delegateKey?.slice(-8)}",
-  accountId: "${accountObjectId?.slice(0, 10)}...",
+  key: "${PRIVATE_KEY_PLACEHOLDER}",
+  accountId: "${accountObjectId ?? ACCOUNT_ID_PLACEHOLDER}",
   serverUrl: "${config.memwalServerUrl}",
 })
 
@@ -457,7 +483,11 @@ const result = await generateText({
                                 <input
                                     type="text"
                                     value={newKeyLabel}
-                                    onChange={(e) => setNewKeyLabel(e.target.value)}
+                                    maxLength={64}
+                                    onChange={(e) =>
+                                        // LOW-31: strip HTML special chars and control characters on every keystroke
+                                        setNewKeyLabel(sanitizeLabel(e.target.value))
+                                    }
                                     placeholder="e.g. MacBook Pro, Production Server"
                                     style={{
                                         width: '100%',

apps/chatbot/app/(auth)/actions.ts

@@ -47,7 +47,6 @@ export type RegisterActionState = {
     | "in_progress"
     | "success"
     | "failed"
-    | "user_exists"
     | "invalid_data";
 };
 
@@ -63,8 +62,10 @@ export const register = async (
 
     const [user] = await getUser(validatedData.email);
 
+    // HIGH-11: Return generic failure — do not reveal whether the email is registered.
+    // Distinct "user_exists" status enables account enumeration.
     if (user) {
-      return { status: "user_exists" } as RegisterActionState;
+      return { status: "failed" };
     }
     await createUser(validatedData.email, validatedData.password);
     await signIn("credentials", {

apps/chatbot/app/(auth)/api/auth/guest/route.ts

@@ -3,9 +3,37 @@ import { getToken } from "next-auth/jwt";
 import { signIn } from "@/app/(auth)/auth";
 import { isDevelopmentEnvironment } from "@/lib/constants";
 
+/**
+ * Validate a redirect target before forwarding to auth.
+ * Allows only:
+ *   - Relative paths beginning with "/" (but not "//", which is protocol-relative)
+ *   - Absolute URLs whose origin matches the request origin (same-origin)
+ * Anything else (external hosts, javascript:, data:, //evil.com) falls back to "/".
+ */
+function isSafeRedirectUrl(redirectUrl: string, requestUrl: string): boolean {
+  // Relative path — safe as long as it isn't protocol-relative ("//host/...")
+  if (redirectUrl.startsWith("/") && !redirectUrl.startsWith("//")) {
+    return true;
+  }
+  // Absolute URL — must share the same origin as the request
+  try {
+    const redirectOrigin = new URL(redirectUrl).origin;
+    const requestOrigin = new URL(requestUrl).origin;
+    return redirectOrigin === requestOrigin;
+  } catch {
+    // Unparseable URL (e.g. "javascript:alert(1)") — reject
+    return false;
+  }
+}
+
 export async function GET(request: Request) {
   const { searchParams } = new URL(request.url);
-  const redirectUrl = searchParams.get("redirectUrl") || "/";
+  const rawRedirectUrl = searchParams.get("redirectUrl") || "/";
+
+  // Reject cross-origin or protocol-relative redirect targets
+  const redirectUrl = isSafeRedirectUrl(rawRedirectUrl, request.url)
+    ? rawRedirectUrl
+    : "/";
 
   const token = await getToken({
     req: request,

apps/chatbot/app/(auth)/register/page.tsx

@@ -26,9 +26,7 @@ export default function Page() {
 
   // biome-ignore lint/correctness/useExhaustiveDependencies: router and updateSession are stable refs
   useEffect(() => {
-    if (state.status === "user_exists") {
-      toast({ type: "error", description: "Account already exists!" });
-    } else if (state.status === "failed") {
+    if (state.status === "failed") {
       toast({ type: "error", description: "Failed to create account!" });
     } else if (state.status === "invalid_data") {
       toast({

apps/chatbot/app/(chat)/actions.ts

@@ -7,14 +7,23 @@ import { titlePrompt } from "@/lib/ai/prompts";
 import { getTitleModel } from "@/lib/ai/providers";
 import {
   deleteMessagesByChatIdAfterTimestamp,
+  getChatById,
   getMessageById,
   updateChatVisibilityById,
 } from "@/lib/db/queries";
 import { getTextFromMessage } from "@/lib/utils";
+import { auth } from "@/app/(auth)/auth";
+import { isProductionEnvironment } from "@/lib/constants";
 
 export async function saveChatModelAsCookie(model: string) {
   const cookieStore = await cookies();
-  cookieStore.set("chat-model", model);
+  // LOW-33: Set Secure (in prod), SameSite=Lax, and constrain path so the
+  // cookie is not sent cross-site and is protected in transit.
+  cookieStore.set("chat-model", model, {
+    path: "/",
+    sameSite: "lax",
+    secure: isProductionEnvironment,
+  });
 }
 
 export async function generateTitleFromUserMessage({
@@ -34,7 +43,21 @@ export async function generateTitleFromUserMessage({
 }
 
 export async function deleteTrailingMessages({ id }: { id: string }) {
+  // HIGH-10: Verify the requesting user owns the chat before deleting messages.
+  const session = await auth();
+  if (!session?.user?.id) {
+    throw new Error("Unauthorized");
+  }
+
   const [message] = await getMessageById({ id });
+  if (!message) {
+    throw new Error("Message not found");
+  }
+
+  const chat = await getChatById({ id: message.chatId });
+  if (!chat || chat.userId !== session.user.id) {
+    throw new Error("Unauthorized");
+  }
 
   await deleteMessagesByChatIdAfterTimestamp({
     chatId: message.chatId,
@@ -49,5 +72,16 @@ export async function updateChatVisibility({
   chatId: string;
   visibility: VisibilityType;
 }) {
+  // HIGH-10: Verify the requesting user owns the chat before changing visibility.
+  const session = await auth();
+  if (!session?.user?.id) {
+    throw new Error("Unauthorized");
+  }
+
+  const chat = await getChatById({ id: chatId });
+  if (!chat || chat.userId !== session.user.id) {
+    throw new Error("Unauthorized");
+  }
+
   await updateChatVisibilityById({ chatId, visibility });
 }