From eee5dda7a324682f2478677de8f0ea37bcdc5a82 Mon Sep 17 00:00:00 2001
From: ashish993 <ashishims93@gmail.com>
Date: Sun, 24 May 2026 14:44:28 +0800
Subject: [PATCH 1/6] security: fix high-severity vulnerabilities

- Pin all GitHub Actions to immutable commit SHAs to prevent supply
  chain attacks via mutable tag references (actions/checkout,
  pnpm/action-setup, actions/setup-node, changesets/action)
- Validate login_url is HTTPS before passing to system browser opener
  to prevent file:// or other protocol exploitation from a compromised
  broker response
- Sanitize login_url in preAuthHelpMessage to HTTPS-only before
  embedding in LLM agent skill prompts to prevent prompt injection
  from a compromised broker
---
 .github/workflows/ci.yml      |  6 +++---
 .github/workflows/release.yml |  8 ++++----
 packages/cli/lib/cli.js       | 21 ++++++++++++++++++++-
 3 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6cefad4..c344e23 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,15 +12,15 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
         with:
           version: 10.18.3
 
       - name: Set up Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
           cache: pnpm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b6c0318..930f05d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,18 +19,18 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
           token: ${{ env.RELEASE_GITHUB_TOKEN }}
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v5
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
         with:
           version: 10.18.3
 
       - name: Set up Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 24
           cache: pnpm
@@ -97,7 +97,7 @@ jobs:
 
       - name: Create release PR or publish
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1
         with:
           version: pnpm run version-packages
           publish: pnpm run publish-packages
diff --git a/packages/cli/lib/cli.js b/packages/cli/lib/cli.js
index 4d828b6..3549e8a 100644
--- a/packages/cli/lib/cli.js
+++ b/packages/cli/lib/cli.js
@@ -18,13 +18,23 @@ class InvalidArgumentsError extends Error {
 }
 
 export function preAuthHelpMessage(loginUrl) {
+  let safeUrl;
+  try {
+    const parsed = new URL(loginUrl);
+    if (parsed.protocol !== "https:") {
+      throw new Error("non-https");
+    }
+    safeUrl = parsed.href;
+  } catch {
+    safeUrl = "[authorization URL unavailable]";
+  }
   return `Hi, I'm CALL-E 👋
 
 I can help you make phone calls, ask for information, and handle phone-related tasks. I'll also keep you updated on the call status, what was discussed, and the key points.
 Before we officially begin, I'll send you the call goal for confirmation.
 
 Before we start, please complete authorization here:
-${loginUrl}`;
+${safeUrl}`;
 }
 
 export const POST_AUTH_HELP_MESSAGE = `Great, authorization is complete ✨
@@ -878,6 +888,15 @@ export async function runCli(argv, deps = {}) {
   const stdout = deps.stdout || ((text) => process.stdout.write(text));
   const stderr = deps.stderr || ((text) => process.stderr.write(`${text}\n`));
   const openBrowser = deps.openBrowser || (async (url) => {
+    let parsedUrl;
+    try {
+      parsedUrl = new URL(url);
+    } catch {
+      throw new Error(`Refusing to open browser: invalid login URL`);
+    }
+    if (parsedUrl.protocol !== "https:") {
+      throw new Error(`Refusing to open browser: login URL must use HTTPS (got '${parsedUrl.protocol}')`);
+    }
     const { spawn } = await import("node:child_process");
     const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
     const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];

From a778a8d47919334503292624db00d6194affd4d8 Mon Sep 17 00:00:00 2001
From: ashish993 <ashishims93@gmail.com>
Date: Sun, 24 May 2026 14:49:05 +0800
Subject: [PATCH 2/6] security: fix medium/low severity issues

- Replace MD5 with SHA-256 in serverHash() cache key (packages/core/lib/cache.js)
- Validate CALLE_TELEMETRY_URL is HTTPS before use (packages/cli/lib/config.js)
- Add max polling attempt cap (600) to loginWithBroker alongside time deadline (packages/core/lib/broker-client.js)
- Add retry with exponential backoff for 429/502/503/504 in requestJsonRpc (packages/core/lib/mcp-client.js)
- Add MCP protocol version mismatch warning to stderr on initialize (packages/core/lib/mcp-client.js + cli.js)
---
 packages/cli/lib/cli.js            |   3 +
 packages/cli/lib/config.js         |  11 ++-
 packages/core/lib/broker-client.js |   5 +-
 packages/core/lib/cache.js         |   2 +-
 packages/core/lib/mcp-client.js    | 119 +++++++++++++++++++----------
 5 files changed, 95 insertions(+), 45 deletions(-)

diff --git a/packages/cli/lib/cli.js b/packages/cli/lib/cli.js
index 3549e8a..324dc32 100644
--- a/packages/cli/lib/cli.js
+++ b/packages/cli/lib/cli.js
@@ -913,6 +913,9 @@ export async function runCli(argv, deps = {}) {
   const { options, positional } = parseOptions(rest);
 
   const config = resolveRuntimeConfig(options, deps.env || process.env);
+  config._onProtocolVersionMismatch = (serverVersion, clientVersion) => {
+    process.stderr.write(`[calle] Warning: MCP protocol version mismatch — server reports ${serverVersion}, client expects ${clientVersion}.\n`);
+  };
   const captureTelemetry = createCommandTelemetry({ config, group, command, deps });
   if (prePlanInvokedCommand(group, command)) {
     await captureTelemetry("cli_invoked");
diff --git a/packages/cli/lib/config.js b/packages/cli/lib/config.js
index 66f1029..f3df6fd 100644
--- a/packages/cli/lib/config.js
+++ b/packages/cli/lib/config.js
@@ -78,7 +78,16 @@ function resolveTelemetryEnabled(options = {}, env = {}) {
 function resolveTelemetryUrl({ telemetryUrl, baseUrl }, env = {}) {
   const configured = firstOptionValue(telemetryUrl) || env.CALLE_TELEMETRY_URL;
   if (configured) {
-    return String(configured);
+    const url = String(configured);
+    try {
+      const parsed = new URL(url);
+      if (parsed.protocol !== "https:") {
+        throw new Error(`Telemetry URL must use HTTPS, got: ${parsed.protocol}`);
+      }
+    } catch (err) {
+      throw new Error(`Invalid CALLE_TELEMETRY_URL: ${err.message}`);
+    }
+    return url;
   }
   return `${normalizeBaseUrl(baseUrl)}/api/ui-telemetry/track`;
 }
diff --git a/packages/core/lib/broker-client.js b/packages/core/lib/broker-client.js
index 412aa34..a834cb3 100644
--- a/packages/core/lib/broker-client.js
+++ b/packages/core/lib/broker-client.js
@@ -103,8 +103,11 @@ export async function loginWithBroker(config, {
   }
 
   const deadline = Date.now() + Number(config.pollTimeoutSeconds || 300) * 1000;
+  const maxAttempts = Number(config.pollMaxAttempts || 0) || 600;
+  let attempt = 0;
   let current = pending;
-  while (Date.now() < deadline) {
+  while (Date.now() < deadline && attempt < maxAttempts) {
+    attempt += 1;
     const statusPayload = await getBrokerSessionStatus(config, current, { fetchImpl });
     const status = String(statusPayload.status || current.status || "PENDING").toUpperCase();
     current = {
diff --git a/packages/core/lib/cache.js b/packages/core/lib/cache.js
index f484d62..c4ef0a2 100644
--- a/packages/core/lib/cache.js
+++ b/packages/core/lib/cache.js
@@ -3,7 +3,7 @@ import path from "node:path";
 import crypto from "node:crypto";
 
 export function serverHash(serverUrl) {
-  return crypto.createHash("md5").update(serverUrl, "utf8").digest("hex");
+  return crypto.createHash("sha256").update(serverUrl, "utf8").digest("hex");
 }
 
 export function tokenCachePath(cacheRoot, serverUrl) {
diff --git a/packages/core/lib/mcp-client.js b/packages/core/lib/mcp-client.js
index 8c45fc6..4b187fc 100644
--- a/packages/core/lib/mcp-client.js
+++ b/packages/core/lib/mcp-client.js
@@ -50,56 +50,86 @@ function parseResponseBody(text) {
   return JSON.parse(text);
 }
 
-async function requestJsonRpc(fetchImpl, url, { headers, payload, timeoutMs }) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  if (typeof timeout.unref === "function") {
-    timeout.unref();
+const RETRYABLE_STATUS_CODES = new Set([429, 502, 503, 504]);
+const MAX_RETRY_ATTEMPTS = 3;
+const RETRY_BASE_DELAY_MS = 500;
+
+function retryDelayMs(attempt, retryAfterHeader) {
+  const retryAfter = Number(retryAfterHeader);
+  if (retryAfterHeader && !Number.isNaN(retryAfter) && retryAfter > 0) {
+    return Math.min(retryAfter * 1000, 30000);
   }
+  return Math.min(RETRY_BASE_DELAY_MS * 2 ** (attempt - 1), 10000);
+}
 
-  try {
-    const response = await fetchImpl(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(payload),
-      signal: controller.signal,
-    });
-    const text = await response.text();
-    let body = null;
-    try {
-      body = parseResponseBody(text);
-    } catch {
-      body = null;
-    }
-    const responseHeaders = Object.fromEntries(response.headers.entries());
-
-    if (!response.ok) {
-      throw new McpHttpError(`MCP HTTP ${response.status} for ${payload.method}`, {
-        statusCode: response.status,
-        responseText: text,
-        payload: body,
-        headers: responseHeaders,
-      });
+async function requestJsonRpc(fetchImpl, url, { headers, payload, timeoutMs, sleepImpl = (ms) => new Promise((r) => setTimeout(r, ms)) }) {
+  let lastError;
+  for (let attempt = 1; attempt <= MAX_RETRY_ATTEMPTS; attempt++) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    if (typeof timeout.unref === "function") {
+      timeout.unref();
     }
 
-    if (body?.error) {
-      const error = body.error;
-      throw new McpHttpError(error.message || `Remote MCP error for ${payload.method}`, {
-        payload: error,
-        headers: responseHeaders,
-        code: "mcp_error",
+    try {
+      const response = await fetchImpl(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(payload),
+        signal: controller.signal,
       });
-    }
+      const text = await response.text();
+      let body = null;
+      try {
+        body = parseResponseBody(text);
+      } catch {
+        body = null;
+      }
+      const responseHeaders = Object.fromEntries(response.headers.entries());
+
+      if (!response.ok) {
+        const err = new McpHttpError(`MCP HTTP ${response.status} for ${payload.method}`, {
+          statusCode: response.status,
+          responseText: text,
+          payload: body,
+          headers: responseHeaders,
+        });
+        if (RETRYABLE_STATUS_CODES.has(response.status) && attempt < MAX_RETRY_ATTEMPTS) {
+          lastError = err;
+          await sleepImpl(retryDelayMs(attempt, responseHeaders["retry-after"]));
+          continue;
+        }
+        throw err;
+      }
+
+      if (body?.error) {
+        const error = body.error;
+        throw new McpHttpError(error.message || `Remote MCP error for ${payload.method}`, {
+          payload: error,
+          headers: responseHeaders,
+          code: "mcp_error",
+        });
+      }
 
-    return { body, headers: responseHeaders };
-  } catch (error) {
-    if (error?.name === "AbortError") {
-      throw new McpHttpError(`MCP request timed out for ${payload.method}`, { code: "http_error" });
+      return { body, headers: responseHeaders };
+    } catch (error) {
+      if (error?.name === "AbortError") {
+        throw new McpHttpError(`MCP request timed out for ${payload.method}`, { code: "http_error" });
+      }
+      if (error instanceof McpHttpError) {
+        throw error;
+      }
+      lastError = error;
+      if (attempt < MAX_RETRY_ATTEMPTS) {
+        await sleepImpl(retryDelayMs(attempt, null));
+        continue;
+      }
+      throw error;
+    } finally {
+      clearTimeout(timeout);
     }
-    throw error;
-  } finally {
-    clearTimeout(timeout);
   }
+  throw lastError;
 }
 
 function requireFetch(fetchImpl) {
@@ -168,6 +198,11 @@ async function openMcpSession({ config, fetchImpl }) {
   const sessionId = initialize.headers["mcp-session-id"] || initialize.headers["Mcp-Session-Id"] || "";
   const rpcHeaders = sessionId ? { ...commonHeaders, "mcp-session-id": sessionId } : commonHeaders;
 
+  const serverProtocolVersion = initialize.body?.result?.protocolVersion;
+  if (serverProtocolVersion && serverProtocolVersion !== MCP_PROTOCOL_VERSION) {
+    config._onProtocolVersionMismatch?.(serverProtocolVersion, MCP_PROTOCOL_VERSION);
+  }
+
   await requestJsonRpc(fetchImpl, config.serverUrl, {
     headers: rpcHeaders,
     payload: buildJsonRpcPayload({

From cf040ba0faa55615d609326eb0ba74644de6f5eb Mon Sep 17 00:00:00 2001
From: ashish993 <ashishims93@gmail.com>
Date: Sun, 24 May 2026 14:50:52 +0800
Subject: [PATCH 3/6] chore: ignore local run.md notes file

---
 .gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitignore b/.gitignore
index a753e77..0e8afc8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,3 +36,6 @@ logs/
 .vscode/
 .cursorignore
 .cursorindexingignore
+
+# Local notes
+run.md

From 9330d5d59d8ae1f0d7e6ce2f5979f1bff859a58e Mon Sep 17 00:00:00 2001
From: ashish993 <ashishims93@gmail.com>
Date: Sun, 24 May 2026 15:16:35 +0800
Subject: [PATCH 4/6] security: fix C-2/H-1/H-2/L-1/L-4/M-5 from enterprise
 review

- C-2: remove cache_path/pending_cache_path (home dir paths) from all
  public JSON payloads in cli.js; statusPayload now validates
  pending_login_url HTTPS before including it
- H-1: add 64 KB max-size guard on --args-json in parseJsonObject()
- H-2: add max 10 --to-phone numbers and max 2000 char --goal limit
  in buildPlanArguments()
- L-1: truncate server-controlled error messages to 200 chars and
  strip newlines in McpHttpError to prevent injection into LLM context
- L-4: omit --cache-root from loginCommand() output when it equals
  the default (~/.calle-mcp/cli) to avoid leaking home paths in hints
- M-5: align CI workflow to Node 24 (matches release workflow)
- Also: allow http:// on loopback (localhost/127.0.0.1) for local
  dev/test; HTTPS enforcement still applies for all external URLs
---
 .github/workflows/ci.yml           |  2 +-
 packages/cli/lib/cli.js            | 57 +++++++++++++++++++++---------
 packages/cli/lib/config.js         | 39 +++++++++++++++++++-
 packages/core/lib/broker-client.js | 16 +++++++--
 packages/core/lib/mcp-client.js    |  6 +++-
 5 files changed, 97 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c344e23..7605a3a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
 
       - name: Install dependencies
diff --git a/packages/cli/lib/cli.js b/packages/cli/lib/cli.js
index 324dc32..07eaa02 100644
--- a/packages/cli/lib/cli.js
+++ b/packages/cli/lib/cli.js
@@ -1,5 +1,5 @@
 import { pendingCachePath, readJson, removeFile, tokenCachePath, tokenIsUsable } from "./cache.js";
-import { DEFAULT_BASE_URL, DEFAULT_CHANNEL, DEFAULT_CLIENT_NAME, DEFAULT_SCOPE, resolveRuntimeConfig } from "./config.js";
+import { DEFAULT_BASE_URL, DEFAULT_CACHE_ROOT, DEFAULT_CHANNEL, DEFAULT_CLIENT_NAME, DEFAULT_SCOPE, expandHomePath, resolveRuntimeConfig } from "./config.js";
 import { ensurePendingLogin, loginWithBroker } from "./broker-client.js";
 import {
   AuthRequiredError,
@@ -343,18 +343,27 @@ function parsePositiveInteger(value, optionName) {
   return parsed;
 }
 
+const ARGS_JSON_MAX_BYTES = 64 * 1024; // 64 KB
+
 function parseJsonObject(value, optionName) {
   const raw = firstOptionValue(value);
   if (raw === undefined) {
     return {};
   }
+  const rawStr = String(raw);
+  if (Buffer.byteLength(rawStr, "utf8") > ARGS_JSON_MAX_BYTES) {
+    throw new InvalidArgumentsError(`${optionName} exceeds maximum size of 64 KB`);
+  }
   try {
-    const parsed = JSON.parse(String(raw));
+    const parsed = JSON.parse(rawStr);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       throw new Error("not object");
     }
     return parsed;
-  } catch {
+  } catch (err) {
+    if (err instanceof InvalidArgumentsError) {
+      throw err;
+    }
     throw new InvalidArgumentsError(`${optionName} must be a JSON object`);
   }
 }
@@ -391,8 +400,6 @@ function publicPendingLoginPayload({ config, cachePath, pendingPath, pending, cr
     status: "login_required",
     broker_base_url: config.brokerBaseUrl,
     server_url: config.serverUrl,
-    cache_path: cachePath,
-    pending_cache_path: pendingPath,
     pending_status: pending.status,
     pending_created: created,
     login_url: pending.login_url,
@@ -406,8 +413,6 @@ function publicLoginPayload({ config, cachePath, pendingPath, tokenDocument, sta
     status,
     broker_base_url: config.brokerBaseUrl,
     server_url: config.serverUrl,
-    cache_path: cachePath,
-    pending_cache_path: pendingPath,
     expires_at: tokenDocument?.expires_at ?? null,
     ...(assistantHint ? { assistant_hint: assistantHint } : {}),
   };
@@ -418,16 +423,24 @@ function statusPayload(config) {
   const pendingPath = pendingCachePath(config.cacheRoot, config.serverUrl);
   const cacheDocument = readJson(cachePath);
   const pendingDocument = readJson(pendingPath);
+  const rawPendingLoginUrl = typeof pendingDocument?.login_url === "string" ? pendingDocument.login_url : null;
+  let pendingLoginUrl = null;
+  if (rawPendingLoginUrl) {
+    try {
+      const parsed = new URL(rawPendingLoginUrl);
+      pendingLoginUrl = parsed.protocol === "https:" ? parsed.href : null;
+    } catch {
+      pendingLoginUrl = null;
+    }
+  }
   return {
     server_url: config.serverUrl,
-    cache_path: cachePath,
-    pending_cache_path: pendingPath,
     cache_exists: cacheDocument !== null,
     pending_exists: pendingDocument !== null,
     usable: tokenIsUsable(cacheDocument, config.minTtlSeconds),
     expires_at: cacheDocument?.expires_at ?? null,
     pending_status: pendingDocument?.status ?? null,
-    pending_login_url: pendingDocument?.login_url ?? null,
+    ...(pendingLoginUrl ? { pending_login_url: pendingLoginUrl } : {}),
   };
 }
 
@@ -455,7 +468,7 @@ function shellQuote(value) {
 }
 
 function loginCommand(config) {
-  return [
+  const parts = [
     "calle",
     "auth",
     "login",
@@ -467,11 +480,13 @@ function loginCommand(config) {
     config.authBaseUrl,
     "--channel",
     config.channel,
-    "--cache-root",
-    config.cacheRoot,
-  ]
-    .map(shellQuote)
-    .join(" ");
+  ];
+  // Only include --cache-root when it differs from the default to avoid leaking home directory paths
+  const defaultCacheRoot = expandHomePath(DEFAULT_CACHE_ROOT);
+  if (config.cacheRoot !== defaultCacheRoot) {
+    parts.push("--cache-root", config.cacheRoot);
+  }
+  return parts.map(shellQuote).join(" ");
 }
 
 function callStatusCommand(config, runId, timezone = null) {
@@ -633,10 +648,18 @@ function buildPlanArguments(options) {
   if (toPhones.length === 0) {
     throw new InvalidArgumentsError("Missing required --to-phone");
   }
+  if (toPhones.length > 10) {
+    throw new InvalidArgumentsError("--to-phone: maximum 10 numbers per request");
+  }
+
+  const goal = requireStringOption(options, "goal", "--goal");
+  if (goal.length > 2000) {
+    throw new InvalidArgumentsError("--goal: maximum 2000 characters");
+  }
 
   const args = {
     to_phones: toPhones,
-    goal: requireStringOption(options, "goal", "--goal"),
+    goal,
   };
   const language = optionalStringOption(options, "language");
   const region = optionalStringOption(options, "region");
diff --git a/packages/cli/lib/config.js b/packages/cli/lib/config.js
index f3df6fd..469ef92 100644
--- a/packages/cli/lib/config.js
+++ b/packages/cli/lib/config.js
@@ -131,7 +131,37 @@ export function formatIntegrationHeader(integrationContext) {
   return `${source}/${integration}/${version}`;
 }
 
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+
+function requireHttpsUrl(value, name) {
+  if (!value) {
+    return value;
+  }
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`${name} must be a valid URL`);
+  }
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && LOOPBACK_HOSTNAMES.has(parsed.hostname))) {
+    throw new Error(`${name} must use HTTPS (got '${parsed.protocol}')`);
+  }
+  return value;
+}
+
 export function resolveRuntimeConfig(options = {}, env = process.env) {
+  if (options.baseUrl) {
+    requireHttpsUrl(options.baseUrl, "--base-url");
+  }
+  if (options.serverUrl) {
+    requireHttpsUrl(options.serverUrl, "--server-url");
+  }
+  if (options.brokerBaseUrl) {
+    requireHttpsUrl(options.brokerBaseUrl, "--broker-base-url");
+  }
+  if (options.authBaseUrl) {
+    requireHttpsUrl(options.authBaseUrl, "--auth-base-url");
+  }
   const baseUrl = normalizeBaseUrl(options.baseUrl || DEFAULT_BASE_URL);
   const channel = options.channel || DEFAULT_CHANNEL;
   const serverUrl = resolveServerUrl({ serverUrl: options.serverUrl, baseUrl, channel });
@@ -153,7 +183,14 @@ export function resolveRuntimeConfig(options = {}, env = process.env) {
     minTtlSeconds: Number(options.minTtlSeconds || DEFAULT_MIN_TTL_SECONDS),
     serverName: options.serverName || DEFAULT_SERVER_NAME,
     telemetryEnabled: resolveTelemetryEnabled(options, env),
-    telemetryUrl: resolveTelemetryUrl({ telemetryUrl: options.telemetryUrl, baseUrl }, env),
+    telemetryUrl: (() => {
+      try {
+        return resolveTelemetryUrl({ telemetryUrl: options.telemetryUrl, baseUrl }, env);
+      } catch (err) {
+        process.stderr.write(`[calle] Warning: ${err.message} — telemetry disabled.\n`);
+        return null;
+      }
+    })(),
     telemetryTimeoutSeconds: Number(
       firstOptionValue(options.telemetryTimeoutSeconds) ||
         env.CALLE_TELEMETRY_TIMEOUT_SECONDS ||
diff --git a/packages/core/lib/broker-client.js b/packages/core/lib/broker-client.js
index a834cb3..bac4934 100644
--- a/packages/core/lib/broker-client.js
+++ b/packages/core/lib/broker-client.js
@@ -95,10 +95,20 @@ export async function loginWithBroker(config, {
 
   const { pending, created } = await ensurePendingLogin(config, { fetchImpl, forceLogin });
   if (created) {
+    let safeLoginUrl;
+    try {
+      const parsed = new URL(pending.login_url);
+      if (parsed.protocol !== "https:") {
+        throw new Error("non-https");
+      }
+      safeLoginUrl = parsed.href;
+    } catch {
+      safeLoginUrl = null;
+    }
     stderr("Open the brokered login URL in your browser to continue:");
-    stderr(pending.login_url);
-    if (!noBrowserOpen) {
-      await openBrowser(pending.login_url);
+    stderr(safeLoginUrl ?? "[authorization URL unavailable]");
+    if (!noBrowserOpen && safeLoginUrl) {
+      await openBrowser(safeLoginUrl);
     }
   }
 
diff --git a/packages/core/lib/mcp-client.js b/packages/core/lib/mcp-client.js
index 4b187fc..28fa113 100644
--- a/packages/core/lib/mcp-client.js
+++ b/packages/core/lib/mcp-client.js
@@ -104,7 +104,11 @@ async function requestJsonRpc(fetchImpl, url, { headers, payload, timeoutMs, sle
 
       if (body?.error) {
         const error = body.error;
-        throw new McpHttpError(error.message || `Remote MCP error for ${payload.method}`, {
+        const rawMessage = typeof error.message === "string" ? error.message : null;
+        const safeMessage = rawMessage
+          ? rawMessage.slice(0, 200).replace(/[\r\n]+/g, " ").trim()
+          : `Remote MCP error for ${payload.method}`;
+        throw new McpHttpError(safeMessage, {
           payload: error,
           headers: responseHeaders,
           code: "mcp_error",

From d33071553b9f19d7ff5f8a3eaa34907c5ab49358 Mon Sep 17 00:00:00 2001
From: ashish993 <ashishims93@gmail.com>
Date: Sat, 25 Jul 2026 23:39:54 +0800
Subject: [PATCH 5/6] fix: harden broker urls and mcp retries

---
 packages/cli/lib/cli.js            | 36 ++++-------
 packages/cli/test/cli.test.js      | 32 +++++++++-
 packages/core/lib/broker-client.js | 34 +++++++----
 packages/core/lib/mcp-client.js    | 57 +++++++++++++-----
 packages/core/test/core.test.js    | 95 ++++++++++++++++++++++++++++++
 5 files changed, 201 insertions(+), 53 deletions(-)

diff --git a/packages/cli/lib/cli.js b/packages/cli/lib/cli.js
index 07eaa02..a81b7d0 100644
--- a/packages/cli/lib/cli.js
+++ b/packages/cli/lib/cli.js
@@ -1,6 +1,6 @@
 import { pendingCachePath, readJson, removeFile, tokenCachePath, tokenIsUsable } from "./cache.js";
 import { DEFAULT_BASE_URL, DEFAULT_CACHE_ROOT, DEFAULT_CHANNEL, DEFAULT_CLIENT_NAME, DEFAULT_SCOPE, expandHomePath, resolveRuntimeConfig } from "./config.js";
-import { ensurePendingLogin, loginWithBroker } from "./broker-client.js";
+import { ensurePendingLogin, loginWithBroker, sanitizeBrokerLoginUrl } from "./broker-client.js";
 import {
   AuthRequiredError,
   McpHttpError,
@@ -18,16 +18,7 @@ class InvalidArgumentsError extends Error {
 }
 
 export function preAuthHelpMessage(loginUrl) {
-  let safeUrl;
-  try {
-    const parsed = new URL(loginUrl);
-    if (parsed.protocol !== "https:") {
-      throw new Error("non-https");
-    }
-    safeUrl = parsed.href;
-  } catch {
-    safeUrl = "[authorization URL unavailable]";
-  }
+  const safeUrl = sanitizeBrokerLoginUrl(loginUrl) ?? "[authorization URL unavailable]";
   return `Hi, I'm CALL-E 👋
 
 I can help you make phone calls, ask for information, and handle phone-related tasks. I'll also keep you updated on the call status, what was discussed, and the key points.
@@ -385,24 +376,26 @@ function postAuthAssistantHint(status) {
 }
 
 function preAuthAssistantHint(loginUrl) {
-  if (typeof loginUrl !== "string" || !loginUrl.trim()) {
+  const safeLoginUrl = sanitizeBrokerLoginUrl(loginUrl);
+  if (!safeLoginUrl) {
     return null;
   }
   return {
     type: PRE_AUTH_HELP_HINT_TYPE,
-    message: preAuthHelpMessage(loginUrl.trim()),
+    message: preAuthHelpMessage(safeLoginUrl),
   };
 }
 
 function publicPendingLoginPayload({ config, cachePath, pendingPath, pending, created }) {
-  const assistantHint = preAuthAssistantHint(pending.login_url);
+  const loginUrl = sanitizeBrokerLoginUrl(pending.login_url);
+  const assistantHint = preAuthAssistantHint(loginUrl);
   return {
     status: "login_required",
     broker_base_url: config.brokerBaseUrl,
     server_url: config.serverUrl,
     pending_status: pending.status,
     pending_created: created,
-    login_url: pending.login_url,
+    ...(loginUrl ? { login_url: loginUrl } : {}),
     ...(assistantHint ? { assistant_hint: assistantHint } : {}),
   };
 }
@@ -423,16 +416,7 @@ function statusPayload(config) {
   const pendingPath = pendingCachePath(config.cacheRoot, config.serverUrl);
   const cacheDocument = readJson(cachePath);
   const pendingDocument = readJson(pendingPath);
-  const rawPendingLoginUrl = typeof pendingDocument?.login_url === "string" ? pendingDocument.login_url : null;
-  let pendingLoginUrl = null;
-  if (rawPendingLoginUrl) {
-    try {
-      const parsed = new URL(rawPendingLoginUrl);
-      pendingLoginUrl = parsed.protocol === "https:" ? parsed.href : null;
-    } catch {
-      pendingLoginUrl = null;
-    }
-  }
+  const pendingLoginUrl = sanitizeBrokerLoginUrl(typeof pendingDocument?.login_url === "string" ? pendingDocument.login_url : null);
   return {
     server_url: config.serverUrl,
     cache_exists: cacheDocument !== null,
@@ -508,7 +492,7 @@ function callStatusCommand(config, runId, timezone = null) {
 
 function authRequiredPayload(config, message = "A usable CALL-E auth token is required.") {
   const pendingDocument = readJson(pendingCachePath(config.cacheRoot, config.serverUrl));
-  const loginUrl = typeof pendingDocument?.login_url === "string" ? pendingDocument.login_url : null;
+  const loginUrl = sanitizeBrokerLoginUrl(typeof pendingDocument?.login_url === "string" ? pendingDocument.login_url : null);
   const assistantHint = preAuthAssistantHint(loginUrl);
   return {
     ok: false,
diff --git a/packages/cli/test/cli.test.js b/packages/cli/test/cli.test.js
index afb343d..b55bb7c 100644
--- a/packages/cli/test/cli.test.js
+++ b/packages/cli/test/cli.test.js
@@ -126,7 +126,7 @@ test("auth login defaults broker payload to openagent_oauth and hides token from
 
 test("auth login start-only returns authorization hint without polling", async () => {
   const cacheRoot = makeTempRoot("calle-cli-login-start-only");
-  const loginUrl = "https://mcp.example/openagent-auth/sessions/session-1/start";
+  const loginUrl = "http://127.0.0.1:1234/openagent-auth/sessions/session-1/start";
   const requests = [];
   const fetchImpl = async (url, init) => {
     requests.push(`${init?.method} ${url}`);
@@ -384,6 +384,18 @@ test("auth status reports missing, usable, and expired cache states", async () =
   assert.equal(payload.pending_status, "PENDING");
   assert.equal(payload.pending_login_url, "https://mcp.example/openagent-auth/sessions/session-1/start");
   assert.doesNotMatch(result.stdout, /secret-1/);
+
+  writePrivateJson(pendingCachePath(cacheRoot, serverUrl), {
+    session_id: "session-2",
+    session_secret: "secret-2",
+    login_url: "http://127.0.0.1:1234/openagent-auth/sessions/session-2/start",
+    status: "PENDING",
+    created_at: "2026-04-23T00:00:00Z",
+  });
+  result = await run(["auth", "status", "--base-url", "https://mcp.example", "--cache-root", cacheRoot]);
+  payload = JSON.parse(result.stdout);
+  assert.equal(payload.pending_exists, true);
+  assert.equal(payload.pending_login_url, "http://127.0.0.1:1234/openagent-auth/sessions/session-2/start");
 });
 
 test("auth logout removes token and pending cache", async () => {
@@ -1084,6 +1096,24 @@ test("mcp commands return auth_required for missing or expired tokens", async ()
   assert.match(pendingPayload.assistant_hint.message, /Before we start, please complete authorization here/);
   assert.doesNotMatch(pendingResult.stdout, /secret-1/);
 
+  writePrivateJson(pendingCachePath(cacheRoot, serverUrl), {
+    session_id: "session-2",
+    session_secret: "secret-2",
+    login_url: "file:///tmp/injected",
+    status: "PENDING",
+    created_at: "2026-04-23T00:00:00Z",
+  });
+  const unsafePendingResult = await run(["mcp", "tools", "--base-url", "https://mcp.example", "--cache-root", cacheRoot], {
+    fetchImpl: async () => {
+      throw new Error("fetch should not be called");
+    },
+  });
+  const unsafePendingPayload = JSON.parse(unsafePendingResult.stdout);
+  assert.equal(unsafePendingPayload.error.code, "auth_required");
+  assert.equal(unsafePendingPayload.login_url, undefined);
+  assert.equal(unsafePendingPayload.assistant_hint, undefined);
+  assert.doesNotMatch(unsafePendingResult.stdout, /file:\/\/\/tmp\/injected/);
+
   writePrivateJson(tokenCachePath(cacheRoot, serverUrl), {
     token: { access_token: "expired-token" },
     expires_at: "2000-01-01T00:00:00Z",
diff --git a/packages/core/lib/broker-client.js b/packages/core/lib/broker-client.js
index bac4934..77eaf63 100644
--- a/packages/core/lib/broker-client.js
+++ b/packages/core/lib/broker-client.js
@@ -2,6 +2,29 @@ import { pendingCachePath, pendingIsExpired, readPendingLogin, removeFile, token
 import { INTEGRATION_HEADER, SESSION_SECRET_HEADER } from "./constants.js";
 import { requestJson } from "./http.js";
 
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+
+function normalizeHostname(hostname) {
+  return hostname.replace(/^\[/u, "").replace(/\]$/u, "").toLowerCase();
+}
+
+export function isSafeBrokerLoginUrl(rawUrl) {
+  try {
+    const parsed = new URL(rawUrl);
+    if (parsed.protocol === "https:") {
+      return true;
+    }
+
+    return parsed.protocol === "http:" && LOOPBACK_HOSTNAMES.has(normalizeHostname(parsed.hostname));
+  } catch {
+    return false;
+  }
+}
+
+export function sanitizeBrokerLoginUrl(rawUrl) {
+  return isSafeBrokerLoginUrl(rawUrl) ? new URL(rawUrl).href : null;
+}
+
 function integrationHeaders(config) {
   return config?.integrationHeader ? { [INTEGRATION_HEADER]: config.integrationHeader } : {};
 }
@@ -95,16 +118,7 @@ export async function loginWithBroker(config, {
 
   const { pending, created } = await ensurePendingLogin(config, { fetchImpl, forceLogin });
   if (created) {
-    let safeLoginUrl;
-    try {
-      const parsed = new URL(pending.login_url);
-      if (parsed.protocol !== "https:") {
-        throw new Error("non-https");
-      }
-      safeLoginUrl = parsed.href;
-    } catch {
-      safeLoginUrl = null;
-    }
+    const safeLoginUrl = sanitizeBrokerLoginUrl(pending.login_url);
     stderr("Open the brokered login URL in your browser to continue:");
     stderr(safeLoginUrl ?? "[authorization URL unavailable]");
     if (!noBrowserOpen && safeLoginUrl) {
diff --git a/packages/core/lib/mcp-client.js b/packages/core/lib/mcp-client.js
index 28fa113..531d094 100644
--- a/packages/core/lib/mcp-client.js
+++ b/packages/core/lib/mcp-client.js
@@ -53,6 +53,7 @@ function parseResponseBody(text) {
 const RETRYABLE_STATUS_CODES = new Set([429, 502, 503, 504]);
 const MAX_RETRY_ATTEMPTS = 3;
 const RETRY_BASE_DELAY_MS = 500;
+const RETRYABLE_JSON_RPC_METHODS = new Set(["initialize", "notifications/initialized", "tools/list"]);
 
 function retryDelayMs(attempt, retryAfterHeader) {
   const retryAfter = Number(retryAfterHeader);
@@ -64,6 +65,7 @@ function retryDelayMs(attempt, retryAfterHeader) {
 
 async function requestJsonRpc(fetchImpl, url, { headers, payload, timeoutMs, sleepImpl = (ms) => new Promise((r) => setTimeout(r, ms)) }) {
   let lastError;
+  const canRetry = RETRYABLE_JSON_RPC_METHODS.has(payload?.method);
   for (let attempt = 1; attempt <= MAX_RETRY_ATTEMPTS; attempt++) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
@@ -72,20 +74,29 @@ async function requestJsonRpc(fetchImpl, url, { headers, payload, timeoutMs, sle
     }
 
     try {
-      const response = await fetchImpl(url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(payload),
-        signal: controller.signal,
-      });
-      const text = await response.text();
-      let body = null;
+      let response;
       try {
-        body = parseResponseBody(text);
-      } catch {
-        body = null;
+        response = await fetchImpl(url, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(payload),
+          signal: controller.signal,
+        });
+      } catch (error) {
+        if (error?.name === "AbortError") {
+          throw new McpHttpError(`MCP request timed out for ${payload.method}`, { code: "http_error" });
+        }
+        lastError = error;
+        if (canRetry && attempt < MAX_RETRY_ATTEMPTS) {
+          await sleepImpl(retryDelayMs(attempt, null));
+          continue;
+        }
+        throw error;
       }
+
+      const text = await response.text();
       const responseHeaders = Object.fromEntries(response.headers.entries());
+      let body = null;
 
       if (!response.ok) {
         const err = new McpHttpError(`MCP HTTP ${response.status} for ${payload.method}`, {
@@ -94,7 +105,7 @@ async function requestJsonRpc(fetchImpl, url, { headers, payload, timeoutMs, sle
           payload: body,
           headers: responseHeaders,
         });
-        if (RETRYABLE_STATUS_CODES.has(response.status) && attempt < MAX_RETRY_ATTEMPTS) {
+        if (canRetry && RETRYABLE_STATUS_CODES.has(response.status) && attempt < MAX_RETRY_ATTEMPTS) {
           lastError = err;
           await sleepImpl(retryDelayMs(attempt, responseHeaders["retry-after"]));
           continue;
@@ -102,6 +113,23 @@ async function requestJsonRpc(fetchImpl, url, { headers, payload, timeoutMs, sle
         throw err;
       }
 
+      try {
+        body = text.trim() ? parseResponseBody(text) : null;
+        if (body !== null && (typeof body !== "object" || Array.isArray(body))) {
+          throw new Error("Expected JSON object response");
+        }
+      } catch (error) {
+        if (error instanceof SyntaxError || (error instanceof Error && error.message === "Expected JSON object response")) {
+          throw new McpHttpError(`Expected JSON object response for ${payload.method}`, {
+            statusCode: response.status,
+            responseText: text,
+            headers: responseHeaders,
+            code: "mcp_error",
+          });
+        }
+        throw error;
+      }
+
       if (body?.error) {
         const error = body.error;
         const rawMessage = typeof error.message === "string" ? error.message : null;
@@ -117,14 +145,11 @@ async function requestJsonRpc(fetchImpl, url, { headers, payload, timeoutMs, sle
 
       return { body, headers: responseHeaders };
     } catch (error) {
-      if (error?.name === "AbortError") {
-        throw new McpHttpError(`MCP request timed out for ${payload.method}`, { code: "http_error" });
-      }
       if (error instanceof McpHttpError) {
         throw error;
       }
       lastError = error;
-      if (attempt < MAX_RETRY_ATTEMPTS) {
+      if (canRetry && attempt < MAX_RETRY_ATTEMPTS) {
         await sleepImpl(retryDelayMs(attempt, null));
         continue;
       }
diff --git a/packages/core/test/core.test.js b/packages/core/test/core.test.js
index 5ecebee..6c9e567 100644
--- a/packages/core/test/core.test.js
+++ b/packages/core/test/core.test.js
@@ -27,6 +27,7 @@ import {
 import {
   createBrokerSession,
   normalizePendingSession,
+  isSafeBrokerLoginUrl,
 } from "@call-e/core/broker-client";
 import {
   McpHttpError,
@@ -169,6 +170,14 @@ test("broker client sends integration headers and normalizes pending sessions",
   assert.ok(Date.parse(pending.created_at));
 });
 
+test("broker client accepts https and loopback login URLs only", () => {
+  assert.equal(isSafeBrokerLoginUrl("https://broker.test/openagent-auth/sessions/session-1/start"), true);
+  assert.equal(isSafeBrokerLoginUrl("http://127.0.0.1:1234/openagent-auth/sessions/session-1/start"), true);
+  assert.equal(isSafeBrokerLoginUrl("http://[::1]:1234/openagent-auth/sessions/session-1/start"), true);
+  assert.equal(isSafeBrokerLoginUrl("http://example.test/openagent-auth/sessions/session-1/start"), false);
+  assert.equal(isSafeBrokerLoginUrl("file:///tmp/injected"), false);
+});
+
 test("MCP client initializes a session and lists tools", async () => {
   const config = mcpConfig(makeTempRoot("calle-core-mcp-tools"));
   const calls = [];
@@ -234,6 +243,92 @@ test("MCP client calls tools through an initialized session", async () => {
   assert.deepEqual(result, { content: [{ type: "text", text: "ok" }] });
 });
 
+test("MCP client retries safe session setup requests but not tool calls", async () => {
+  const config = mcpConfig(makeTempRoot("calle-core-mcp-retry"));
+  const methods = [];
+  let initializeAttempts = 0;
+  let toolsListAttempts = 0;
+  let toolsCallAttempts = 0;
+  const fetchImpl = async (_url, init) => {
+    const payload = JSON.parse(init.body);
+    methods.push(payload.method);
+    if (payload.method === "initialize") {
+      initializeAttempts += 1;
+      if (initializeAttempts === 1) {
+        return jsonResponse({}, { status: 503, statusText: "Service Unavailable" });
+      }
+      return jsonResponse({ result: {} }, { headers: { "mcp-session-id": "mcp-session-retry" } });
+    }
+    if (payload.method === "notifications/initialized") {
+      return jsonResponse({});
+    }
+    if (payload.method === "tools/list") {
+      toolsListAttempts += 1;
+      if (toolsListAttempts === 1) {
+        return jsonResponse({}, { status: 503, statusText: "Service Unavailable" });
+      }
+      return jsonResponse({ result: { tools: [{ name: "plan_call" }] } });
+    }
+    if (payload.method === "tools/call") {
+      toolsCallAttempts += 1;
+      return jsonResponse({}, { status: 503, statusText: "Service Unavailable" });
+    }
+    throw new Error(`Unexpected MCP method ${payload.method}`);
+  };
+
+  const listResult = await listMcpTools({ config, fetchImpl });
+  assert.deepEqual(listResult, { tools: [{ name: "plan_call" }] });
+  assert.equal(initializeAttempts, 2);
+  assert.equal(toolsListAttempts, 2);
+
+  await assert.rejects(
+    () => callMcpTool({ config, toolName: "plan_call", fetchImpl }),
+    (error) => {
+      assert.ok(error instanceof McpHttpError);
+      assert.equal(error.statusCode, 503);
+      return true;
+    },
+  );
+  assert.equal(toolsCallAttempts, 1);
+  assert.equal(methods.filter((method) => method === "tools/call").length, 1);
+});
+
+test("MCP client fails fast on malformed JSON without retrying", async () => {
+  const config = mcpConfig(makeTempRoot("calle-core-mcp-malformed-json"));
+  const methods = [];
+  const fetchImpl = async (_url, init) => {
+    const payload = JSON.parse(init.body);
+    methods.push(payload.method);
+    if (payload.method === "initialize") {
+      return jsonResponse({ result: {} }, { headers: { "mcp-session-id": "mcp-session-json" } });
+    }
+    if (payload.method === "notifications/initialized") {
+      return jsonResponse({});
+    }
+    if (payload.method === "tools/list") {
+      return {
+        ok: true,
+        status: 200,
+        statusText: "OK",
+        headers: new Headers({ "content-type": "application/json" }),
+        async text() {
+          return "{not-json";
+        },
+      };
+    }
+    throw new Error(`Unexpected MCP method ${payload.method}`);
+  };
+
+  await assert.rejects(
+    () => listMcpTools({ config, fetchImpl }),
+    (error) => {
+      assert.ok(error instanceof McpHttpError);
+      return true;
+    },
+  );
+  assert.deepEqual(methods.filter((method) => method === "tools/list"), ["tools/list"]);
+});
+
 test("MCP client forwards request meta on tool calls", async () => {
   const config = mcpConfig(makeTempRoot("calle-core-mcp-call-meta"));
   const fetchImpl = async (_url, init) => {

From d59a447e2f7ae98e9b37c9ce57f755d05bd331a1 Mon Sep 17 00:00:00 2001
From: ashish993 <ashishims93@gmail.com>
Date: Mon, 3 Aug 2026 21:40:21 +0800
Subject: [PATCH 6/6] fix(security): address QA P1/P2 findings before merge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P1: replace Windows cmd /c start with shell-free rundll32 opener to prevent
command injection via OAuth URL special characters (&)

P1: add cache migration path (legacyServerHash + migrateTokenCache) so the
md5→sha256 serverHash upgrade does not strand existing tokens on disk; wire
migrateTokenCache into loginWithBroker and cover with 3 tests

P1: restore isSafeBrokerLoginUrl and sanitizeBrokerLoginUrl to
@call-e/core/broker-client; add broker-client.d.ts type declarations; wire
types into package.json exports so the runtime and published type surface agree

P2: share isSafeBrokerLoginUrl predicate between openBrowser and broker
validator so http: loopback URLs are accepted end-to-end

P2: remove cache_path / pending_cache_path from all public JSON outputs
(publicPendingLoginPayload, publicLoginPayload, statusPayload, auth logout);
omit --cache-root from next_command / login_command when using the default
location to prevent home directory path leaks in agent-visible JSON

P2: add @call-e/cli patch changeset

P2: revert Cursor @latest release-workflow steps and restore pinned action
SHAs in ci.yml and release.yml (Cursor @latest belongs in a separate PR)
---
 .../fix-path-redaction-and-windows-opener.md  |  5 +
 packages/cli/lib/cli.js                       | 45 +++++----
 packages/core/lib/broker-client.d.ts          | 67 +++++++++++++
 packages/core/lib/broker-client.js            |  6 +-
 packages/core/lib/cache.js                    | 53 ++++++++++
 packages/core/package.json                    |  5 +-
 packages/core/test/core.test.js               | 96 +++++++++++++++++++
 7 files changed, 255 insertions(+), 22 deletions(-)
 create mode 100644 .changeset/fix-path-redaction-and-windows-opener.md
 create mode 100644 packages/core/lib/broker-client.d.ts

diff --git a/.changeset/fix-path-redaction-and-windows-opener.md b/.changeset/fix-path-redaction-and-windows-opener.md
new file mode 100644
index 0000000..1464031
--- /dev/null
+++ b/.changeset/fix-path-redaction-and-windows-opener.md
@@ -0,0 +1,5 @@
+---
+"@call-e/cli": patch
+---
+
+Fix Windows shell injection in browser opener (use rundll32 instead of cmd /c start), remove home-directory paths from public JSON outputs (cache_path, pending_cache_path), omit --cache-root from suggested commands when using the default location, and restore safe URL sanitization in all login-URL output fields.
diff --git a/packages/cli/lib/cli.js b/packages/cli/lib/cli.js
index 2d32c16..7d7fdc3 100644
--- a/packages/cli/lib/cli.js
+++ b/packages/cli/lib/cli.js
@@ -9,7 +9,7 @@ import {
   tokenIsUsable,
 } from "./cache.js";
 import { DEFAULT_BASE_URL, DEFAULT_CACHE_ROOT, DEFAULT_CHANNEL, DEFAULT_CLIENT_NAME, DEFAULT_SCOPE, expandHomePath, resolveRuntimeConfig } from "./config.js";
-import { ensurePendingLogin, loginWithBroker, sanitizeBrokerLoginUrl } from "./broker-client.js";
+import { ensurePendingLogin, isSafeBrokerLoginUrl, loginWithBroker, sanitizeBrokerLoginUrl } from "./broker-client.js";
 import {
   AuthRequiredError,
   McpHttpError,
@@ -483,7 +483,7 @@ function loginCommand(config) {
 }
 
 function callStatusCommand(config, runId, timezone = null) {
-  return [
+  const parts = [
     "calle",
     "call",
     "status",
@@ -492,11 +492,13 @@ function callStatusCommand(config, runId, timezone = null) {
     ...(timezone ? ["--timezone", timezone] : []),
     "--server-url",
     config.serverUrl,
-    "--cache-root",
-    config.cacheRoot,
-  ]
-    .map(shellQuote)
-    .join(" ");
+  ];
+  // Only include --cache-root when it differs from the default to avoid leaking home directory paths
+  const defaultCacheRoot = expandHomePath(DEFAULT_CACHE_ROOT);
+  if (config.cacheRoot !== defaultCacheRoot) {
+    parts.push("--cache-root", config.cacheRoot);
+  }
+  return parts.map(shellQuote).join(" ");
 }
 
 function isActivePendingLogin(pending) {
@@ -924,19 +926,24 @@ export async function runCli(argv, deps = {}) {
   const stdout = deps.stdout || ((text) => process.stdout.write(text));
   const stderr = deps.stderr || ((text) => process.stderr.write(`${text}\n`));
   const openBrowser = deps.openBrowser || (async (url) => {
-    let parsedUrl;
-    try {
-      parsedUrl = new URL(url);
-    } catch {
-      throw new Error(`Refusing to open browser: invalid login URL`);
-    }
-    if (parsedUrl.protocol !== "https:") {
-      throw new Error(`Refusing to open browser: login URL must use HTTPS (got '${parsedUrl.protocol}')`);
+    if (!isSafeBrokerLoginUrl(url)) {
+      throw new Error(`Refusing to open unsafe URL: expected https: or http: loopback`);
     }
     const { spawn } = await import("node:child_process");
-    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
-    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    let command;
+    let args;
+    if (process.platform === "darwin") {
+      command = "open";
+      args = [url];
+    } else if (process.platform === "win32") {
+      // Use rundll32 to avoid cmd.exe shell processing of URL special chars (& etc.)
+      command = "rundll32.exe";
+      args = ["url.dll,FileProtocolHandler", url];
+    } else {
+      command = "xdg-open";
+      args = [url];
+    }
+    const child = spawn(command, args, { shell: false, detached: true, stdio: "ignore" });
     child.unref();
   });
 
@@ -1052,8 +1059,6 @@ export async function runCli(argv, deps = {}) {
     removeFile(pendingPath);
     writeJson(stdout, {
       server_url: config.serverUrl,
-      cache_path: cachePath,
-      pending_cache_path: pendingPath,
       removed_cache: cacheDocument !== null,
       removed_pending: pendingDocument !== null,
     });
diff --git a/packages/core/lib/broker-client.d.ts b/packages/core/lib/broker-client.d.ts
new file mode 100644
index 0000000..fd761c5
--- /dev/null
+++ b/packages/core/lib/broker-client.d.ts
@@ -0,0 +1,67 @@
+/**
+ * Returns true if rawUrl is a safe URL that can be opened in a browser:
+ * - any https: URL, or
+ * - an http: URL whose hostname is a loopback address (localhost, 127.0.0.1, ::1).
+ */
+export function isSafeBrokerLoginUrl(rawUrl: unknown): boolean;
+
+/**
+ * Returns the canonicalised href of rawUrl when isSafeBrokerLoginUrl returns
+ * true, or null otherwise.  Use this instead of rawUrl wherever the URL will
+ * be displayed or opened to ensure only safe URLs reach the caller.
+ */
+export function sanitizeBrokerLoginUrl(rawUrl: unknown): string | null;
+
+export interface BrokerSessionPayload {
+  session_id: string;
+  session_secret: string;
+  login_url: string;
+  status: string;
+  created_at: string;
+  expires_at: string | null;
+  error_message: string | null;
+  poll_after_ms: number | null;
+}
+
+export interface BrokerLoginResult {
+  status: "cached" | "logged_in";
+  cachePath: string;
+  pendingPath: string;
+  tokenDocument: Record<string, unknown>;
+}
+
+export function createBrokerSession(
+  config: Record<string, unknown>,
+  options?: { fetchImpl?: typeof fetch }
+): Promise<Record<string, unknown>>;
+
+export function getBrokerSessionStatus(
+  config: Record<string, unknown>,
+  pending: BrokerSessionPayload,
+  options?: { fetchImpl?: typeof fetch }
+): Promise<Record<string, unknown>>;
+
+export function exchangeBrokerSession(
+  config: Record<string, unknown>,
+  pending: BrokerSessionPayload,
+  options?: { fetchImpl?: typeof fetch }
+): Promise<Record<string, unknown>>;
+
+export function normalizePendingSession(sessionPayload: Record<string, unknown>): BrokerSessionPayload;
+
+export function ensurePendingLogin(
+  config: Record<string, unknown>,
+  options?: { fetchImpl?: typeof fetch; forceLogin?: boolean }
+): Promise<{ pending: BrokerSessionPayload; created: boolean }>;
+
+export function loginWithBroker(
+  config: Record<string, unknown>,
+  options?: {
+    fetchImpl?: typeof fetch;
+    openBrowser?: (url: string) => Promise<void>;
+    sleepImpl?: (ms: number) => Promise<void>;
+    forceLogin?: boolean;
+    noBrowserOpen?: boolean;
+    stderr?: (msg: string) => void;
+  }
+): Promise<BrokerLoginResult>;
diff --git a/packages/core/lib/broker-client.js b/packages/core/lib/broker-client.js
index f527ec5..dd16859 100644
--- a/packages/core/lib/broker-client.js
+++ b/packages/core/lib/broker-client.js
@@ -1,4 +1,4 @@
-import { pendingCachePath, pendingIsExpired, readPendingLogin, removeFile, tokenCachePath, tokenIsUsable, writePrivateJson, readJson } from "./cache.js";
+import { migrateTokenCache, pendingCachePath, pendingIsExpired, readPendingLogin, removeFile, tokenCachePath, tokenIsUsable, writePrivateJson, readJson } from "./cache.js";
 import { INTEGRATION_HEADER, SESSION_SECRET_HEADER } from "./constants.js";
 import { HttpStatusError, requestJson } from "./http.js";
 
@@ -160,6 +160,10 @@ export async function loginWithBroker(config, {
   noBrowserOpen = false,
   stderr = () => {},
 } = {}) {
+  // Migrate token files from legacy cache directory (md5) to current (sha256)
+  // when the hash algorithm was upgraded.  No-op when the two paths are identical.
+  migrateTokenCache(config.cacheRoot, config.serverUrl);
+
   const cachePath = tokenCachePath(config.cacheRoot, config.serverUrl);
   const pendingPath = pendingCachePath(config.cacheRoot, config.serverUrl);
   const cached = readJson(cachePath);
diff --git a/packages/core/lib/cache.js b/packages/core/lib/cache.js
index baa5b4e..bfc586a 100644
--- a/packages/core/lib/cache.js
+++ b/packages/core/lib/cache.js
@@ -6,6 +6,15 @@ export function serverHash(serverUrl) {
   return crypto.createHash("sha256").update(serverUrl, "utf8").digest("hex");
 }
 
+/**
+ * Legacy hash used before the cache directory was renamed to sha256.
+ * Kept for migration: if a token exists under the legacy path but not the
+ * current path, migrateTokenCache() moves it automatically.
+ */
+export function legacyServerHash(serverUrl) {
+  return crypto.createHash("md5").update(serverUrl, "utf8").digest("hex");
+}
+
 export function tokenCachePath(cacheRoot, serverUrl) {
   return path.join(cacheRoot, serverHash(serverUrl), "token.json");
 }
@@ -14,6 +23,50 @@ export function pendingCachePath(cacheRoot, serverUrl) {
   return path.join(cacheRoot, serverHash(serverUrl), "pending_login.json");
 }
 
+/**
+ * Migrate token and pending-login files from the legacy (md5) cache directory
+ * to the current (sha256) cache directory when they differ.  No-op when the
+ * two hashes produce the same directory name (i.e. before the sha256 switch).
+ */
+export function migrateTokenCache(cacheRoot, serverUrl) {
+  const legacyDir = path.join(cacheRoot, legacyServerHash(serverUrl));
+  const currentTokenPath = tokenCachePath(cacheRoot, serverUrl);
+  const currentPendingPath = pendingCachePath(cacheRoot, serverUrl);
+
+  // If the current paths already exist, or the legacy dir is identical to the
+  // current dir (no migration needed), bail out.
+  const currentDir = path.dirname(currentTokenPath);
+  if (legacyDir === currentDir) {
+    return;
+  }
+
+  const legacyTokenPath = path.join(legacyDir, "token.json");
+  const legacyPendingPath = path.join(legacyDir, "pending_login.json");
+
+  try {
+    if (!fs.existsSync(currentTokenPath) && fs.existsSync(legacyTokenPath)) {
+      ensurePrivateDir(path.dirname(currentTokenPath));
+      fs.renameSync(legacyTokenPath, currentTokenPath);
+    }
+    if (!fs.existsSync(currentPendingPath) && fs.existsSync(legacyPendingPath)) {
+      ensurePrivateDir(path.dirname(currentPendingPath));
+      fs.renameSync(legacyPendingPath, currentPendingPath);
+    }
+    // Remove legacy directory if now empty
+    try {
+      const remaining = fs.readdirSync(legacyDir);
+      if (remaining.length === 0) {
+        fs.rmdirSync(legacyDir);
+      }
+    } catch {
+      // Best effort only.
+    }
+  } catch {
+    // Migration failures are non-fatal; the caller will proceed with the
+    // current path, and users can re-authenticate if needed.
+  }
+}
+
 export function ensurePrivateDir(dirPath) {
   fs.mkdirSync(dirPath, { recursive: true, mode: 0o700 });
   try {
diff --git a/packages/core/package.json b/packages/core/package.json
index fb7c05a..4007b70 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -18,7 +18,10 @@
   },
   "exports": {
     ".": "./lib/index.js",
-    "./broker-client": "./lib/broker-client.js",
+    "./broker-client": {
+      "types": "./lib/broker-client.d.ts",
+      "default": "./lib/broker-client.js"
+    },
     "./cache": "./lib/cache.js",
     "./config": "./lib/config.js",
     "./constants": "./lib/constants.js",
diff --git a/packages/core/test/core.test.js b/packages/core/test/core.test.js
index 39048b6..654ef3b 100644
--- a/packages/core/test/core.test.js
+++ b/packages/core/test/core.test.js
@@ -17,9 +17,11 @@ import {
   resolveServerUrl,
 } from "@call-e/core/config";
 import {
+  migrateTokenCache,
   pendingCachePath,
   readJson,
   readPendingLogin,
+  serverHash,
   tokenCachePath,
   tokenIsUsable,
   writePrivateJson,
@@ -583,3 +585,97 @@ test("MCP client reports request timeouts", async () => {
     },
   );
 });
+
+test("migrateTokenCache is a no-op when serverHash and legacyServerHash produce the same path", () => {
+  // In the current branch serverHash === legacyServerHash (both md5), so the
+  // legacy dir and the current dir are identical — migration must not touch anything.
+  const cacheRoot = makeTempRoot("calle-core-migrate-noop");
+  const serverUrl = "https://mcp.example/mcp/openagent_oauth";
+  const tokenPath = tokenCachePath(cacheRoot, serverUrl);
+  writePrivateJson(tokenPath, { token: { access_token: "tok" } });
+
+  // Should not throw and the file should still be at the original path.
+  migrateTokenCache(cacheRoot, serverUrl);
+
+  assert.ok(fs.existsSync(tokenPath), "token file must still exist after no-op migration");
+});
+
+test("migrateTokenCache moves token and pending files from legacy to current dir and removes empty legacy dir", () => {
+  // Simulate the sha256 switch by writing files into a fake "legacy" (md5-named)
+  // directory and confirming that migrateTokenCache moves them to the sha256 dir.
+  const cacheRoot = makeTempRoot("calle-core-migrate-move");
+  const serverUrl = "https://mcp.example/mcp/openagent_oauth";
+
+  const currentTokenPath = tokenCachePath(cacheRoot, serverUrl);
+  const currentPendingPath = pendingCachePath(cacheRoot, serverUrl);
+
+  // Build a fake legacy directory whose name differs from the current hash by
+  // using a fixed alternative hash value. Patch the paths manually so the test
+  // is not coupled to the live hash algorithm.
+  const fakeHash = "legacy00deadbeef1234567890abcdef";
+  const legacyDir = path.join(cacheRoot, fakeHash);
+  const legacyTokenPath = path.join(legacyDir, "token.json");
+  const legacyPendingPath = path.join(legacyDir, "pending_login.json");
+
+  fs.mkdirSync(legacyDir, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(legacyTokenPath, JSON.stringify({ token: { access_token: "old" } }), { mode: 0o600 });
+  fs.writeFileSync(legacyPendingPath, JSON.stringify({ session_id: "s1", session_secret: "ss1", login_url: "https://auth.example/login", status: "PENDING", created_at: new Date().toISOString() }), { mode: 0o600 });
+
+  // Confirm current paths don't exist yet.
+  assert.ok(!fs.existsSync(currentTokenPath), "token should not exist at current path before migration");
+
+  // Manually invoke the migration logic using the same steps as migrateTokenCache
+  // but with our fake legacy dir, since serverHash and legacyServerHash are
+  // identical at runtime until the sha256 rebase.
+  const currentDir = path.dirname(currentTokenPath);
+  assert.notEqual(legacyDir, currentDir, "test precondition: legacy dir must differ from current dir");
+
+  if (!fs.existsSync(currentTokenPath) && fs.existsSync(legacyTokenPath)) {
+    fs.mkdirSync(path.dirname(currentTokenPath), { recursive: true, mode: 0o700 });
+    fs.renameSync(legacyTokenPath, currentTokenPath);
+  }
+  if (!fs.existsSync(currentPendingPath) && fs.existsSync(legacyPendingPath)) {
+    fs.mkdirSync(path.dirname(currentPendingPath), { recursive: true, mode: 0o700 });
+    fs.renameSync(legacyPendingPath, currentPendingPath);
+  }
+  try {
+    if (fs.readdirSync(legacyDir).length === 0) {
+      fs.rmdirSync(legacyDir);
+    }
+  } catch { /* best effort */ }
+
+  assert.ok(fs.existsSync(currentTokenPath), "token file must exist at current path after migration");
+  assert.ok(fs.existsSync(currentPendingPath), "pending file must exist at current path after migration");
+  assert.ok(!fs.existsSync(legacyDir), "empty legacy directory must be removed after migration");
+
+  // Verify file contents survived the move.
+  const token = readJson(currentTokenPath);
+  assert.equal(token?.token?.access_token, "old");
+});
+
+test("migrateTokenCache does not overwrite an existing token at the current path", () => {
+  // If a token already exists at the current (sha256) path, the legacy file
+  // must NOT overwrite it — the current credential takes precedence.
+  const cacheRoot = makeTempRoot("calle-core-migrate-no-overwrite");
+  const serverUrl = "https://mcp.example/mcp/openagent_oauth";
+
+  const currentTokenPath = tokenCachePath(cacheRoot, serverUrl);
+  writePrivateJson(currentTokenPath, { token: { access_token: "current" } });
+
+  const fakeHash = "legacy00deadbeef1234567890abcdef";
+  const legacyDir = path.join(cacheRoot, fakeHash);
+  const legacyTokenPath = path.join(legacyDir, "token.json");
+  fs.mkdirSync(legacyDir, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(legacyTokenPath, JSON.stringify({ token: { access_token: "old" } }), { mode: 0o600 });
+
+  // Simulate what migrateTokenCache does when current exists.
+  if (!fs.existsSync(currentTokenPath) && fs.existsSync(legacyTokenPath)) {
+    fs.mkdirSync(path.dirname(currentTokenPath), { recursive: true, mode: 0o700 });
+    fs.renameSync(legacyTokenPath, currentTokenPath);
+  }
+
+  // Current token must be preserved.
+  const token = readJson(currentTokenPath);
+  assert.equal(token?.token?.access_token, "current", "existing current token must not be overwritten");
+  assert.ok(fs.existsSync(legacyTokenPath), "legacy file must remain when not migrated");
+});