creatixchu 01d68dee4e fix(connection): fence every /api request behind one browser-trust check ...

The only browser-trust guard covered host.pickDirectory, while the
consequential methods (session.prompt drives bash) accepted any Host —
open to DNS rebinding, where a rebound page reads and writes the API as
if same-origin and only the Host header betrays the attacker's domain.

The pickDirectory-specific loopback guard becomes a prefix-wide fence:
Host must be loopback or an exact host[:port] from the new trustedHosts
config, an attached Origin must equal that authority, and explicit
cross-site markers are refused; requests without browser markers (curl,
tests, native clients) pass, because without a browser there is no
confused deputy. The loopback-socket check is dropped — binding policy
expresses reachability, and the fence is not an auth layer. The Agent
Note records the full threat model and the alternatives.

2026-07-28 14:56:45 +08:00

..

notes

fix(connection): fence every /api request behind one browser-trust check

2026-07-28 14:56:45 +08:00

skills

refactor(dev-infra): narrow change scope report

2026-07-28 01:02:43 +08:00