security: Fix command injection, CORS, force unwraps, add API auth

- CRITICAL: GitIntegrationTool rewritten to use Process.arguments array
  instead of bash -c shell interpolation (command injection)
- Removed wildcard CORS from NovaAPIServer
- Added bearer token auth on all POST endpoints
- Fixed force unwrap in SessionManager (Application Support path)
- Fixed force unwrap in LogViewerPanel (selectedCategories)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: kochj23

MLX Code/Services/NovaAPIServer.swift

@@ -31,6 +31,17 @@ class NovaAPIServer {
     private var listener: NWListener?
     private let startTime = Date()
 
+    /// Local-only anti-CSRF bearer token (not a secret — just prevents drive-by POST from browser JS)
+    private let apiToken: String = {
+        let key = "NovaAPIToken"
+        if let existing = UserDefaults.standard.string(forKey: key), !existing.isEmpty {
+            return existing
+        }
+        let token = UUID().uuidString
+        UserDefaults.standard.set(token, forKey: key)
+        return token
+    }()
+
     private init() {}
 
     func start() {
@@ -69,6 +80,13 @@ class NovaAPIServer {
     private func route(_ req: NovaRequest) async -> String {
         if req.method == "OPTIONS" { return http(200, "") }
 
+        // Require bearer token for all POST/DELETE requests (anti-CSRF)
+        if req.method == "POST" || req.method == "DELETE" {
+            guard let auth = req.headers["authorization"], auth == "Bearer \(apiToken)" else {
+                return json(401, ["error": "Unauthorized — missing or invalid Bearer token"])
+            }
+        }
+
         switch (req.method, req.path) {
 
         case ("GET", "/api/status"):
@@ -185,6 +203,7 @@ class NovaAPIServer {
         let method: String
         let path: String
         let body: String
+        let headers: [String: String]
         func bodyJSON() -> [String: Any]? {
             guard let data = body.data(using: .utf8) else { return nil }
             return try? JSONSerialization.jsonObject(with: data) as? [String: Any]
@@ -206,6 +225,7 @@ class NovaAPIServer {
             method = tokens[0]
             path = tokens[1].components(separatedBy: "?").first ?? tokens[1]
             body = rawBody
+            headers = hdrs
         }
     }
 
@@ -222,7 +242,7 @@ class NovaAPIServer {
     }
 
     private func http(_ status: Int, _ body: String, _ ct: String = "text/plain") -> String {
-        let st = [200:"OK",201:"Created",400:"Bad Request",404:"Not Found",500:"Internal Server Error"][status] ?? "Unknown"
-        return "HTTP/1.1 \(status) \(st)\r\nContent-Type: \(ct); charset=utf-8\r\nContent-Length: \(body.utf8.count)\r\nAccess-Control-Allow-Origin: *\r\nConnection: close\r\n\r\n\(body)"
+        let st = [200:"OK",201:"Created",400:"Bad Request",401:"Unauthorized",404:"Not Found",500:"Internal Server Error"][status] ?? "Unknown"
+        return "HTTP/1.1 \(status) \(st)\r\nContent-Type: \(ct); charset=utf-8\r\nContent-Length: \(body.utf8.count)\r\nConnection: close\r\n\r\n\(body)"
     }
 }

MLX Code/Services/SessionManager.swift

@@ -17,7 +17,11 @@ class SessionManager: ObservableObject {
 
     private let fileManager = FileManager.default
     private var sessionFile: URL {
-        let appSupport = fileManager.urls(for: .applicationSupportDirectory, in: .userDomainMask).first!
+        guard let appSupport = fileManager.urls(for: .applicationSupportDirectory, in: .userDomainMask).first else {
+            let fallback = fileManager.homeDirectoryForCurrentUser.appendingPathComponent(".mlxcode/Sessions")
+            try? fileManager.createDirectory(at: fallback, withIntermediateDirectories: true)
+            return fallback.appendingPathComponent("current_session.json")
+        }
         let dir = appSupport.appendingPathComponent("MLX Code/Sessions")
         try? fileManager.createDirectory(at: dir, withIntermediateDirectories: true)
         return dir.appendingPathComponent("current_session.json")

MLX Code/Tools/GitIntegrationTool.swift

@@ -93,7 +93,7 @@ class GitIntegrationTool: BaseTool {
     // MARK: - Git Operations
 
     private func gitStatus(context: ToolContext) async throws -> ToolResult {
-        let output = try await runGitCommand("status --porcelain -b", in: context.workingDirectory)
+        let output = try await runGitCommand(["status", "--porcelain", "-b"], in: context.workingDirectory)
 
         let lines = output.components(separatedBy: .newlines).filter { !$0.isEmpty }
         var branch = "unknown"
@@ -170,9 +170,13 @@ class GitIntegrationTool: BaseTool {
 
     private func gitDiff(parameters: [String: Any], context: ToolContext) async throws -> ToolResult {
         let filePath = parameters["file_path"] as? String
-        let command = filePath != nil ? "diff \(filePath!)" : "diff"
+        var args = ["diff"]
+        if let filePath = filePath {
+            args.append("--")
+            args.append(filePath)
+        }
 
-        let output = try await runGitCommand(command, in: context.workingDirectory)
+        let output = try await runGitCommand(args, in: context.workingDirectory)
 
         var result = "# Git Diff\n\n"
 
@@ -190,9 +194,10 @@ class GitIntegrationTool: BaseTool {
 
     private func gitAdd(parameters: [String: Any], context: ToolContext) async throws -> ToolResult {
         let files = parameters["files"] as? [String] ?? ["."]
-        let filesStr = files.joined(separator: " ")
+        var args = ["add", "--"]
+        args.append(contentsOf: files)
 
-        _ = try await runGitCommand("add \(filesStr)", in: context.workingDirectory)
+        _ = try await runGitCommand(args, in: context.workingDirectory)
 
         var result = "# Files Staged\n\n"
         for file in files {
@@ -208,16 +213,15 @@ class GitIntegrationTool: BaseTool {
 
         if generateMessage || message == nil {
             // Generate commit message from diff
-            let diff = try await runGitCommand("diff --cached", in: context.workingDirectory)
+            let diff = try await runGitCommand(["diff", "--cached"], in: context.workingDirectory)
             message = generateCommitMessage(from: diff)
         }
 
         guard let commitMessage = message, !commitMessage.isEmpty else {
             throw ToolError.missingParameter("Commit message is required")
         }
 
-        let escapedMessage = commitMessage.replacingOccurrences(of: "\"", with: "\\\"")
-        _ = try await runGitCommand("commit -m \"\(escapedMessage)\"", in: context.workingDirectory)
+        _ = try await runGitCommand(["commit", "-m", commitMessage], in: context.workingDirectory)
 
         var result = "# Commit Created\n\n"
         result += "**Message**:\n```\n\(commitMessage)\n```\n\n"
@@ -227,7 +231,7 @@ class GitIntegrationTool: BaseTool {
     }
 
     private func gitPush(context: ToolContext) async throws -> ToolResult {
-        let output = try await runGitCommand("push", in: context.workingDirectory)
+        let output = try await runGitCommand(["push"], in: context.workingDirectory)
 
         var result = "# Push Complete\n\n"
         result += "```\n\(output)\n```\n"
@@ -236,7 +240,7 @@ class GitIntegrationTool: BaseTool {
     }
 
     private func gitPull(context: ToolContext) async throws -> ToolResult {
-        let output = try await runGitCommand("pull", in: context.workingDirectory)
+        let output = try await runGitCommand(["pull"], in: context.workingDirectory)
 
         var result = "# Pull Complete\n\n"
         result += "```\n\(output)\n```\n"
@@ -246,7 +250,7 @@ class GitIntegrationTool: BaseTool {
 
     private func gitLog(parameters: [String: Any], context: ToolContext) async throws -> ToolResult {
         let limit = parameters["limit"] as? Int ?? 10
-        let output = try await runGitCommand("log --oneline -n \(limit)", in: context.workingDirectory)
+        let output = try await runGitCommand(["log", "--oneline", "-n", "\(limit)"], in: context.workingDirectory)
 
         var result = "# Git Log (last \(limit) commits)\n\n"
         result += "```\n\(output)\n```\n"
@@ -257,8 +261,8 @@ class GitIntegrationTool: BaseTool {
     private func gitBranch(parameters: [String: Any], context: ToolContext) async throws -> ToolResult {
         let branchName = parameters["branch"] as? String
 
-        let command = branchName != nil ? "branch \(branchName!)" : "branch -a"
-        let output = try await runGitCommand(command, in: context.workingDirectory)
+        let args: [String] = branchName != nil ? ["branch", branchName!] : ["branch", "-a"]
+        let output = try await runGitCommand(args, in: context.workingDirectory)
 
         var result = "# Git Branches\n\n"
         result += "```\n\(output)\n```\n"
@@ -271,7 +275,7 @@ class GitIntegrationTool: BaseTool {
             throw ToolError.missingParameter("Branch name required for checkout")
         }
 
-        let output = try await runGitCommand("checkout \(branch)", in: context.workingDirectory)
+        let output = try await runGitCommand(["checkout", branch], in: context.workingDirectory)
 
         var result = "# Checked Out Branch\n\n"
         result += "**Branch**: \(branch)\n\n"
@@ -285,7 +289,7 @@ class GitIntegrationTool: BaseTool {
             throw ToolError.missingParameter("Branch name required for merge")
         }
 
-        let output = try await runGitCommand("merge \(branch)", in: context.workingDirectory)
+        let output = try await runGitCommand(["merge", branch], in: context.workingDirectory)
 
         var result = "# Merge Complete\n\n"
         result += "**Merged**: \(branch) into current branch\n\n"
@@ -299,7 +303,7 @@ class GitIntegrationTool: BaseTool {
             throw ToolError.missingParameter("file_path required for blame")
         }
 
-        let output = try await runGitCommand("blame \(filePath)", in: context.workingDirectory)
+        let output = try await runGitCommand(["blame", "--", filePath], in: context.workingDirectory)
 
         var result = "# Git Blame\n\n"
         result += "**File**: \(filePath)\n\n"
@@ -309,7 +313,7 @@ class GitIntegrationTool: BaseTool {
     }
 
     private func gitStash(parameters: [String: Any], context: ToolContext) async throws -> ToolResult {
-        let output = try await runGitCommand("stash", in: context.workingDirectory)
+        let output = try await runGitCommand(["stash"], in: context.workingDirectory)
 
         var result = "# Changes Stashed\n\n"
         result += "```\n\(output)\n```\n"
@@ -319,21 +323,27 @@ class GitIntegrationTool: BaseTool {
 
     // MARK: - Helper Methods
 
-    private func runGitCommand(_ command: String, in directory: String) async throws -> String {
+    /// Execute a git command safely using Process.arguments array form.
+    /// SECURITY: Never passes arguments through a shell — prevents command injection.
+    private func runGitCommand(_ args: [String], in directory: String) async throws -> String {
         let process = Process()
-        process.executableURL = URL(fileURLWithPath: "/bin/bash")
+        process.executableURL = URL(fileURLWithPath: "/usr/bin/git")
         process.currentDirectoryURL = URL(fileURLWithPath: directory)
-        process.arguments = ["-c", "git \(command) 2>&1"]
+        process.arguments = args
 
-        let pipe = Pipe()
-        process.standardOutput = pipe
-        process.standardError = pipe
+        let stdoutPipe = Pipe()
+        let stderrPipe = Pipe()
+        process.standardOutput = stdoutPipe
+        process.standardError = stderrPipe
 
         try process.run()
         process.waitUntilExit()
 
-        let data = pipe.fileHandleForReading.readDataToEndOfFile()
-        let output = String(data: data, encoding: .utf8) ?? ""
+        let stdoutData = stdoutPipe.fileHandleForReading.readDataToEndOfFile()
+        let stderrData = stderrPipe.fileHandleForReading.readDataToEndOfFile()
+        let stdout = String(data: stdoutData, encoding: .utf8) ?? ""
+        let stderr = String(data: stderrData, encoding: .utf8) ?? ""
+        let output = stdout + (stderr.isEmpty ? "" : "\n" + stderr)
 
         if process.terminationStatus != 0 && !output.isEmpty && output.contains("fatal") {
             throw ToolError.executionFailed("Git command failed: \(output)")

MLX Code/Views/LogViewerPanel.swift

@@ -192,7 +192,7 @@ struct LogViewerPanel: View {
         if logManager.selectedCategories.isEmpty {
             return "All"
         } else if logManager.selectedCategories.count == 1 {
-            return logManager.selectedCategories.first!
+            return logManager.selectedCategories.first ?? "All"
         } else {
             return "\(logManager.selectedCategories.count) selected"
         }