jason.woltjeandClaude Opus 5.5 d1629d610d fix(board): refuse foreign Host and Origin on every control-board route (#1507) ...

After a DNS rebind, a web page could read /api/board and POST /api/reply,
which pastes into a live seat pane. foreignRequest() now runs first and
returns 403 for a non-loopback Host, a wrong port, userinfo or a path in
Host, or any Origin other than http://<Host>. A missing Origin still passes,
which covers the WebUI proxy. Dewey authored it; Rocko approved de9ff942
(review 5a12f08e) with one low wording finding, now fixed in the notes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-09-26 15:40:34 -05:00

..

control-board

fix(board): refuse foreign Host and Origin on every control-board route (#1507)

2026-09-26 15:40:34 -05:00

discord

feat(discord): SetSpark record client for the Discord Sage, fixed verbs against setspark-api, connector-verified approvals (#1509)

2026-09-22 12:59:39 -05:00

ledger

fix(ledger): count the T3 header as agent, control-board sender as board (#1506)

2026-09-26 15:16:55 -05:00

mosaic

Add fixture-only execution materialization and refresh (#1500)

2026-09-10 20:20:44 -05:00

seat

feat(board): session attention, Discord rows, task attribution and relaunch activity (rows 18, 22, #1511, #1512)

2026-09-26 14:54:18 -05:00

webui

fix(webui): pending reply notice until the seat answers, relative Age (#1507)

2026-09-26 15:00:59 -05:00