Harden dev server: loopback bind, drop wildcard CORS, hide feedback bookkeeping

[companygardener]

Summary

Closes #2, #3, #4 — three concrete network-surface issues in lib/server.py.

• Security: dev server binds to all interfaces by default (LAN exposure) #2 (LAN bind): default --bind to 127.0.0.1, expose the flag for users who explicitly want LAN access, print a warning when bound non-loopback.
• Security: wildcard CORS allows cross-origin POSTs to /feedback (CSRF) #3 (CSRF / wildcard CORS): drop Access-Control-Allow-Origin: * and the permissive do_OPTIONS. Reject POSTs whose Origin header is set but doesn't match Host. Same-origin browser requests, the agent, and curl all keep working as before.
• Security: feedback/inbox.jsonl and feedback/lastseen.json are HTTP-readable #4 (feedback bookkeeping HTTP-readable): in do_GET, block any path under /feedback/ except history.json. Normalize the path (posixpath.normpath(unquote(...))) first — without that, /./feedback/inbox.jsonl, /x/../feedback/inbox.jsonl, /feedback//inbox.jsonl, and /%66eedback/inbox.jsonl all reach the file through SimpleHTTPRequestHandler.translate_path.

Also folded in a couple of small robustness fixes that surfaced while doing this:

• Cap POST bodies at 1 MiB and reject non-object JSON with 400 (instead of crashing later on data["..."] = ...).
• Fix a TypeError in log_message when log_error calls it with an int as args[0].

The --bind warning, the same-origin check, and the new SKILL.md notes are intended to make the security model legible to anyone reading the skill.

Test plan

Manually verified against the patched server with curl --path-as-is:

• GET /feedback/inbox.jsonl → 403
• GET /./feedback/inbox.jsonl → 403 (was 200 with naive exact-string check)
• GET /x/../feedback/inbox.jsonl → 403
• GET /feedback//inbox.jsonl → 403
• GET /%66eedback/inbox.jsonl → 403
• GET /feedback/lastseen.json (and bypass variants) → 403
• GET /feedback/history.json → 200 (the in-page library still polls it)
• POST /feedback with Origin: http://evil.example → 403
• POST /feedback with matching Origin → 200
• POST /feedback with no Origin (agent / curl) → 200
• 2 MiB POST /feedback → 413
• Boots cleanly on 127.0.0.1 by default; --bind 0.0.0.0 prints the warning

Known follow-up

The same-origin check compares Origin to Host without validating Host against an allowlist, so a determined DNS-rebinding attacker who can match the dev port could still pass it. The realistic blast radius reduces to writing into the agent's reading context — out of scope for this PR — but a Host-allowlist hardening would be a small, reasonable follow-up.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Hardens server.py against cross-origin and cross-device abuse by adding same-origin POST checks, body-size caps, type validation on JSON bodies, GET-blocking of agent-side files under /feedback/, and a default-loopback bind with an opt-in --bind flag. CORS allow-all and the OPTIONS preflight handler are removed in favor of same-origin-only access.

Changes:

• Restrict /feedback/* GETs to history.json; reject cross-origin POSTs via Origin/Host comparison; enforce a 1 MiB body cap and require JSON objects.
• Bind to 127.0.0.1 by default; add --bind with a LAN-exposure warning; drop CORS wildcard + OPTIONS.
• Document the new bind/origin behavior in SKILL.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
lib/server.py	Adds origin check, body cap, path-normalized GET filter, JSON-object validation, --bind flag, log_message fix.
SKILL.md	Documents loopback default and same-origin POST rejection.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.