feat(web): enforce localhost-only binding; expand loopback origin allow-list#1796

Merged

cliffhall merged 32 commits into

v2/mainfrom

v2/enforce-loopback-bind

Jul 27, 2026

Commits on Jul 26, 2026

feat(web): enforce localhost-only binding; expand loopback origin allow-list (#1795)

cliffhall
and
claude
committed
docs(web): add 'Hosting on a network' note — specific-IP bind + ALLOWED_ORIGINS guidance (#1795)

cliffhall
and
claude
committed
review: harden bind guard + IPv6 loopback consistency across origin/CSP/URLs (#1795)

cliffhall
and
claude
committed
review: round-2 fixes — gate plugin config eval, share host formatter, test CSP (#1795)

cliffhall
and
claude
committed
review: round-3 fixes — close IPv6 wildcard bypass, default-port origin, dedupe formatter (#1795)

cliffhall
and
claude
committed
Merge remote-tracking branch 'origin/v2/main' into v2/enforce-loopback-bind
cliffhall
committed
review: round-4 fixes — zone-index guard crash, CSP header hardening, docs (#1795)

cliffhall
and
claude
committed
review: round-5 fixes — wildcard allow-list, IPv6-in-CSP reality, URL builder (#1795)

cliffhall
and
claude
committed
review: round-6 fixes — empty-ALLOWED_ORIGINS fail-open, 0.0.0.0 is a real origin (#1795)

cliffhall
and
claude
committed
review: round-7 fixes — canonical wildcard origins, sandbox URL, dedup (#1795)

cliffhall
and
claude
committed
review: round-8 fixes — normalize ALLOWED_ORIGINS, reject unusable CLIENT_PORT (#1795)

cliffhall
and
claude
committed
review: round-9 fixes — reject scheme-less ALLOWED_ORIGINS, CLIENT_PORT polish (#1795)

cliffhall
and
claude
committed
review: round-10 fixes — canonicalize the bind host on all origin-list branches (#1795)

cliffhall
and
claude
committed
review: round-11 polish — verify --dev allowedHosts, dedupe port validation, doc fixes (#1795)

cliffhall
and
claude
committed
review: round-12 fixes — strictPort parity on the launcher dev path, unmap IPv4 loopback (#1795)

cliffhall
and
claude
committed
review: round-13 fixes — doc-maintenance for the new file/folder, normalize both branches (#1795)

cliffhall
and
claude
committed
review: round-14 fix — restore banner ⊆ allow-list for mapped-IPv4, unify bracket strip (#1795)

cliffhall
and
claude
committed
review: round-15 fixes — CLI deep-link canonicalization (last Y1 site), doc/structure polish (#1795)

cliffhall
and
claude
committed
review: round-16 doc fixes — stale origin-guard advice, mixed-content Apps caveat (#1795)

cliffhall
and
claude
committed
review: round-17 doc fix — don't recommend [::1] for MCP Apps review (#1795)

cliffhall
and
claude
committed
review: round-18 fix — move isAllInterfacesHost to core/node, wildcard→localhost in CLI deep-link (#1795)

cliffhall
and
claude
committed
review: round-19 fix — close the IDNA/fullwidth wildcard bypass in the bind guard (#1795)

cliffhall
and
claude
committed
review: round-20 fixes — untrack stray tsbuildinfo, self-explaining guard message (#1795)

cliffhall
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(web): enforce localhost-only binding; expand loopback origin allow-list#1796

feat(web): enforce localhost-only binding; expand loopback origin allow-list#1796
cliffhall merged 32 commits into
v2/mainfrom
v2/enforce-loopback-bind

Commits on Jul 26, 2026

feat(web): enforce localhost-only binding; expand loopback origin allow-list (#1795)

docs(web): add 'Hosting on a network' note — specific-IP bind + ALLOWED_ORIGINS guidance (#1795)

review: harden bind guard + IPv6 loopback consistency across origin/CSP/URLs (#1795)

review: round-2 fixes — gate plugin config eval, share host formatter, test CSP (#1795)

review: round-3 fixes — close IPv6 wildcard bypass, default-port origin, dedupe formatter (#1795)

Merge remote-tracking branch 'origin/v2/main' into v2/enforce-loopback-bind

review: round-4 fixes — zone-index guard crash, CSP header hardening, docs (#1795)

review: round-5 fixes — wildcard allow-list, IPv6-in-CSP reality, URL builder (#1795)

review: round-6 fixes — empty-ALLOWED_ORIGINS fail-open, 0.0.0.0 is a real origin (#1795)

review: round-7 fixes — canonical wildcard origins, sandbox URL, dedup (#1795)

review: round-8 fixes — normalize ALLOWED_ORIGINS, reject unusable CLIENT_PORT (#1795)

review: round-9 fixes — reject scheme-less ALLOWED_ORIGINS, CLIENT_PORT polish (#1795)

review: round-10 fixes — canonicalize the bind host on all origin-list branches (#1795)

review: round-11 polish — verify --dev allowedHosts, dedupe port validation, doc fixes (#1795)

review: round-12 fixes — strictPort parity on the launcher dev path, unmap IPv4 loopback (#1795)

review: round-13 fixes — doc-maintenance for the new file/folder, normalize both branches (#1795)

review: round-14 fix — restore banner ⊆ allow-list for mapped-IPv4, unify bracket strip (#1795)

review: round-15 fixes — CLI deep-link canonicalization (last Y1 site), doc/structure polish (#1795)

review: round-16 doc fixes — stale origin-guard advice, mixed-content Apps caveat (#1795)

review: round-17 doc fix — don't recommend [::1] for MCP Apps review (#1795)

review: round-18 fix — move isAllInterfacesHost to core/node, wildcard→localhost in CLI deep-link (#1795)

review: round-19 fix — close the IDNA/fullwidth wildcard bypass in the bind guard (#1795)

review: round-20 fixes — untrack stray tsbuildinfo, self-explaining guard message (#1795)

Commits on Jul 27, 2026

review: round-21 — guard the CLI OAuth callback bind (AF1), message + doc nits (#1795)

review: round-22 — OAuth callback loopback-only + bracket fixes (#1795)

review: round-23 nits — bound isLoopbackHost octets, accept trailing-dot, help text (#1795)

review: round-24 — OAuth guard error is a usage error, not auth_required (#1795)

review: round-25 — preserve CLI exit codes/envelope through the launcher (#1795)

review: round-26 nits — stale-build guard, non-1 exit smoke, DEBUG=0, docs (#1795)

review: round-27 nits — smoke env-pin + docblock, comments (#1795)

review: round-28 — correct dead-cover comments, ALLOWED_ORIGINS-replaces doc (#1795)

review: round-29 — TUI smoke env-pin + root README ALLOWED_ORIGINS recipe (#1795)