@1agh/maude 0.54.0 → 0.56.0

package/apps/studio/http.ts

@@ -22,7 +22,7 @@ import { type Api, ASSET_MAX_BYTES, ASSET_MAX_VIDEO_BYTES } from './api.ts';
 import { ImportAssetError, importSvg, SVG_MAX_BYTES } from './bin/_import-asset.mjs';
 import { ImportBrandError, importBrand } from './bin/_import-brand.mjs';
 import { buildCanvasModule } from './canvas-build.ts';
-import { buildCanvasSandboxed } from './canvas-build-sandbox.ts';
+import { buildCanvasSandboxed, buildStats } from './canvas-build-sandbox.ts';
 import { canvasLibPath } from './canvas-lib-resolver.ts';
 import { TranspileError } from './canvas-pipeline.ts';
 import { createCloudEndpoints } from './cloud/endpoints.ts';
@@ -46,8 +46,15 @@ import { localizeGenAsset } from './generation/download.ts';
 import {
   downloadGemmaModel,
   ffmpegAvailable,
+  getOllamaModel,
   listGemmaModels,
+  listScoutModels,
+  mlxSetup,
   mlxVlmAvailable,
+  OLLAMA_RECOMMENDED_MODEL,
+  ollamaSetupOptions,
+  ollamaStatus,
+  pullOllamaModel,
 } from './generation/gemma-models.ts';
 import { type GenerationJobQueue, GenerationQueueFullError } from './generation/jobs.ts';
 import {
@@ -77,6 +84,8 @@ import {
   getWhisperModel,
   listWhisperModels,
   removeWhisperModel,
+  resolveAutoEngine,
+  whisperSetup,
 } from './generation/whisper-models.ts';
 import { createGitEndpoints } from './git/endpoints.ts';
 import { gitShowFile } from './git/service.ts';
@@ -289,12 +298,53 @@ export function sameOriginWrite(req: Request): boolean {
   const origin = req.headers.get('origin');
   if (!origin) return true; // non-browser / same-origin omitting Origin → allow
   try {
-    return origin === new URL(req.url).origin;
+    // HOSTS, not full origins — the same reason isOwnShellOrigin (studio-proxy)
+    // compares host-only for the collab WS upgrade. In a cell, TLS terminates at
+    // the proxy, so the browser's `https://<host>` Origin reaches a studio that
+    // serves plaintext and computes `req.url` as `http://<host>`; a full-origin
+    // compare then rejects every legitimate shell write on the SCHEME alone
+    // (403 "cross-origin write rejected" — the second half of the inspector-edits
+    // RCA, found when the loopback fix uncovered it). Host+port still pins the
+    // origin: the port rides in `host`, and scheme was never the CSRF
+    // discriminator here — locally everything is http, and a real cross-site page
+    // has a different host.
+    return new URL(origin).host === new URL(req.url).host;
   } catch {
     return false;
   }
 }
 
+/**
+ * The DNS-rebind guard, mode-aware — Cloud Phase 27, the inspector-edits RCA
+ * (`issue-cloud-inspector-edits-refused-by-loopback-guard`).
+ *
+ * `isLoopbackHost(req.headers.get('host'))` is right on a laptop: a malicious
+ * page that resolves `evil.com` → 127.0.0.1 makes the browser send a FOREIGN
+ * Host to the locally-bound dev server, and the guard rejects it. In a CELL that
+ * same check can NEVER pass — the hub's authenticating proxy rewrites Host to the
+ * project's public name (D4, `upstreamHeaders`) on purpose — so every shell edit
+ * (Inspector CSS, artboard ops, insert/delete/reorder, edit-attr/text) 403'd
+ * with "local request required (DNS-rebinding guard)". Annotations and comments
+ * were spared only because their handlers carry no such guard; that split of
+ * which routes worked was exactly the fingerprint of this bug.
+ *
+ * The cell doesn't NEED the Host check: the proxy already terminated the session,
+ * authorized it against the one role table (studio-manifest's `decide()`), and
+ * injects `x-maude-role` after stripping every inbound `x-maude-*` — so the
+ * header's PRESENCE is unforgeable proof the request came through the hub. Same
+ * `WORKSPACE ? x-maude-role` vouch the collab-WS upgrade already trusts
+ * (server.ts, RCA issue-cloud-live-collaboration-dead). Outside workspace mode
+ * this is the loopback check, verbatim.
+ *
+ * Safe against secret leakage by construction: a cell PRUNES every secret-bearing
+ * route family out of its table (`pruneForWorkspace` + the boot-assert), so the
+ * vouched path can only ever reach the project-editing surfaces that survive.
+ */
+export function isTrustedRequestHost(req: Request): boolean {
+  if (isLoopbackHost(req.headers.get('host'))) return true;
+  return isWorkspaceMode() && !!req.headers.get('x-maude-role');
+}
+
 /**
  * CSRF guard for a key-bearing / side-effecting GET (Task 2.5 audio-search —
  * ethical-hacker F1). A cross-site page can issue a `no-cors` GET to
@@ -1108,6 +1158,19 @@ export function createHttp(
         // supervisor hashes its own expected root and compares.
         rootId: rootIdentity(ctx.paths.repoRoot),
         pid: process.pid,
+        // Cloud Phase 26 Stage 4 — the build sandbox's own counters, so the
+        // €3/cell model finally has figures instead of a prediction. Counts and
+        // durations ONLY: never a canvas name, never a path, and never the text
+        // of a rejected import specifier (that specifier is tenant-authored
+        // content — the operational fact is that a rejection happened, not what
+        // it said).
+        //
+        // On `/_health`, which the untrusted canvas origin may read, and that
+        // is deliberate: every figure here is about the reader's OWN cell, so
+        // it discloses nothing across a tenant boundary. Inventing a privileged
+        // route would have meant inventing an auth path for the supervisor's
+        // loopback probe, for data the tenant already has.
+        render: buildStats(),
       }),
 
     '/_active': () => Response.json(inspect().state),
@@ -1124,7 +1187,7 @@ export function createHttp(
     // but newly worth closing given what this diff makes it able to reveal.
     '/_api/acp/status': async (req: Request) => {
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       return Response.json(await probeAcpAvailabilityAuthed(), {
         headers: { 'Cache-Control': 'no-store' },
@@ -1142,7 +1205,7 @@ export function createHttp(
     // ChatPanel not-connected explainer + the Help-menu modal read this.
     '/_api/preflight': async (req: Request) => {
       if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       return Response.json(await probeReadiness(), { headers: { 'Cache-Control': 'no-store' } });
     },
@@ -1156,7 +1219,7 @@ export function createHttp(
     // (SetupChecklist.jsx) polls this.
     '/_api/setup-readiness': async (req: Request) => {
       if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       return Response.json(await probeSetupReadiness(ctx), {
         headers: { 'Cache-Control': 'no-store' },
@@ -1172,7 +1235,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       // Fire-and-forget — the install can run past Bun's default 10s idle
       // timeout on a slow network, so this returns as soon as the spawn is
@@ -1193,7 +1256,7 @@ export function createHttp(
     // two routes, which used the wrong guard.
     '/_api/claude/install-status': (req: Request) => {
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       return Response.json(getInstallState(), { headers: { 'Cache-Control': 'no-store' } });
     },
@@ -1210,7 +1273,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const result = startSignin();
       return Response.json(result, {
@@ -1222,7 +1285,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       cancelSignin();
       return Response.json({ ok: true }, { headers: { 'Cache-Control': 'no-store' } });
@@ -1232,7 +1295,7 @@ export function createHttp(
     // Narrowed fields only (never email/orgId/orgName — see login-state.ts).
     '/_api/claude/signin-status': async (req: Request) => {
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const status = await getClaudeAuthStatus();
       return Response.json(
@@ -1250,7 +1313,7 @@ export function createHttp(
       // chat-open` driver omits Origin (allowed); a browser drive-by can't forge it.
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       ctx.bus.emit('acp-focus', {});
       return Response.json({ ok: true }, { headers: { 'Cache-Control': 'no-store' } });
@@ -1276,7 +1339,7 @@ export function createHttp(
       if (req.method === 'PATCH') {
         if (!sameOriginWrite(req))
           return new Response('cross-origin write rejected', { status: 403 });
-        if (!isLoopbackHost(req.headers.get('host')))
+        if (!isTrustedRequestHost(req))
           return new Response('local request required (DNS-rebinding guard)', { status: 403 });
         if (!id) return new Response('missing id', { status: 400 });
         let body: unknown;
@@ -1337,7 +1400,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const declared = Number(req.headers.get('content-length') || '0');
       if (Number.isFinite(declared) && declared > ASSET_MAX_BYTES) {
@@ -1444,7 +1507,7 @@ export function createHttp(
     // /_api/acp/status (a drive-by page must not read logs via DNS rebinding).
     '/_api/debug-bundle': (req: Request) => {
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       return Response.json(
         buildDebugBundle({
@@ -1477,7 +1540,7 @@ export function createHttp(
     '/_api/shell-shot': async (req: Request) => {
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       // Target the very server handling this request — no _server.json read, so
       // a stale/absent state file can't point the capture at another instance.
@@ -1547,7 +1610,7 @@ export function createHttp(
     '/_api/report': async (req: Request) => {
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const endpoint = process.env.MAUDE_REPORT_URL || 'https://cloud.maude.sh/report';
       try {
@@ -1580,7 +1643,7 @@ export function createHttp(
     '/_api/report-fallback': async (req: Request) => {
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ report?: unknown; screenshots?: unknown }>(req);
       if (!body || typeof body.report !== 'object' || body.report === null) {
@@ -1681,7 +1744,7 @@ export function createHttp(
       // the photo-store cap stack (sha8 validate + containment + validatePhotoEdit
       // + size cap) is the load-bearing mitigation. loopback-Host gates DNS-
       // rebinding on every method.
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const asset = new URL(req.url).searchParams.get('asset');
       if (req.method === 'GET') {
@@ -1719,7 +1782,7 @@ export function createHttp(
       // DNS-rebinding on every method; the footage-store cap stack (sha8/slug
       // validate + containment + validate{FootageAnalysis,Edl} + size cap) is the
       // load-bearing mitigation for the caller-derived write path.
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const params = new URL(req.url).searchParams;
       const asset = params.get('asset');
@@ -1762,7 +1825,7 @@ export function createHttp(
       // a rebound page shares this origin; the dev-server always binds 127.0.0.1,
       // so a real browser (Host: localhost:<port>) passes and only a rebound
       // foreign hostname 403s. (No sameOriginWrite here — GET.)
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const file = new URL(req.url).searchParams.get('file');
       const r = await api.loadCanvasSource(file);
@@ -1827,7 +1890,7 @@ export function createHttp(
       // slash-command driver omits Origin (→ allowed); a browser drive-by can't.
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ file?: string; author?: string }>(req);
       if (!body || typeof body.file !== 'string' || !body.file.trim()) {
@@ -1847,7 +1910,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ file?: string }>(req);
       if (!body || typeof body.file !== 'string' || !body.file.trim()) {
@@ -1863,7 +1926,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ file?: string }>(req);
       if (!body || typeof body.file !== 'string' || !body.file.trim()) {
@@ -1924,7 +1987,7 @@ export function createHttp(
       if (req.method === 'DELETE' || req.method === 'POST') {
         if (!sameOriginWrite(req))
           return new Response('cross-origin write rejected', { status: 403 });
-        if (!isLoopbackHost(req.headers.get('host')))
+        if (!isTrustedRequestHost(req))
           return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       }
       if (req.method === 'DELETE') {
@@ -1987,7 +2050,7 @@ export function createHttp(
     '/_api/fs-move': async (req: Request) => {
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       const body = await readJson<{ file?: unknown; toDir?: unknown }>(req, 4 * 1024);
@@ -2018,7 +2081,7 @@ export function createHttp(
     '/_api/fs-mkdir': async (req: Request) => {
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       const body = await readJson<{ parent?: unknown; name?: unknown }>(req, 4 * 1024);
@@ -2079,7 +2142,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.createBranch(body));
@@ -2089,7 +2152,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.checkout(body));
@@ -2101,7 +2164,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('adding a draft requires a local request', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.fold(body));
@@ -2113,7 +2176,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('refresh requires a local request', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.fetchRemote(body));
@@ -2123,7 +2186,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<unknown>(req, 256 * 1024);
       return gitJson(await gitApi.commit(body));
@@ -2133,7 +2196,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<unknown>(req, 256 * 1024);
       return gitJson(await gitApi.discard(body));
@@ -2143,11 +2206,11 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       // Token-bearing: refuse anything not from a loopback Host (the server binds
       // 127.0.0.1, so this is belt-and-suspenders against a forwarded/rebound Host).
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('publish requires a local request', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.push(body));
@@ -2157,7 +2220,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('get latest requires a local request', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.pull(body));
@@ -2171,7 +2234,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('resolve requires a local request', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.resolve(body));
@@ -2192,7 +2255,7 @@ export function createHttp(
       // whose 401 DELETES the stored credential — a confused deputy worth
       // closing (validate 2026-07-30, defender F6).
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(cloudApi.status());
     },
@@ -2200,7 +2263,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(await cloudApi.signinStart());
     },
@@ -2208,7 +2271,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = (await req.json().catch(() => ({}))) as { deviceCode?: string };
       return gitJson(await cloudApi.signinPoll(String(body.deviceCode ?? '')));
@@ -2217,14 +2280,14 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(cloudApi.signout());
     },
     '/_api/cloud/projects': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(await cloudApi.projects());
     },
@@ -2232,7 +2295,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = (await req.json().catch(() => ({}))) as { project?: string };
       return gitJson(await cloudApi.attach(String(body.project ?? '')));
@@ -2244,7 +2307,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = (await req.json().catch(() => ({}))) as { code?: string; project?: string };
       return gitJson(
@@ -2257,14 +2320,14 @@ export function createHttp(
 
     '/_api/github/identity': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(await githubApi.identity());
     },
 
     '/_api/github/repos': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(await githubApi.repos());
     },
@@ -2273,7 +2336,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.createRepo(body));
@@ -2283,7 +2346,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.invite(body));
@@ -2293,7 +2356,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.clone(body));
@@ -2303,7 +2366,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.createProject(body));
@@ -2318,7 +2381,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.createLocalProject(body));
@@ -2331,7 +2394,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.initDesign(body));
@@ -2346,7 +2409,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await linkHub(body));
@@ -2361,7 +2424,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       const result = await signInToWorkspace((body ?? {}) as Record<string, unknown>);
@@ -2377,7 +2440,7 @@ export function createHttp(
     // for, and every route the canvas can reach is one more thing to reason about.
     '/_api/workspace/disclosure': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const url = new URL(req.url);
       const linked = ctx.cfg.linkedHub?.url ?? null;
@@ -2407,7 +2470,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2440,7 +2503,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2473,7 +2536,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2509,7 +2572,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2549,7 +2612,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2585,7 +2648,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2630,7 +2693,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2660,7 +2723,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2697,7 +2760,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2730,7 +2793,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2761,7 +2824,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2795,7 +2858,7 @@ export function createHttp(
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       // DNS-rebinding guard — this GET echoes project source structure; loopback-
       // only Host (real browser passes, rebound hostname 403s). No sameOriginWrite (GET).
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const u = new URL(req.url);
       const result = await api.compClips({
@@ -2821,7 +2884,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ canvas?: unknown; seq?: unknown; dir?: unknown }>(
         req,
@@ -2852,7 +2915,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ canvas?: unknown; id?: unknown; idIndex?: unknown }>(
         req,
@@ -2884,7 +2947,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2919,7 +2982,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2953,7 +3016,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ canvas?: unknown; id?: unknown; idIndex?: unknown }>(
         req,
@@ -2980,7 +3043,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ canvas?: unknown; id?: unknown; idIndex?: unknown }>(
         req,
@@ -3009,7 +3072,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3043,7 +3106,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3072,7 +3135,7 @@ export function createHttp(
       // + startCanvasServer routes (dual-allowlist, DDR-054). Loopback-Host gated
       // (DNS-rebinding); read-only, so no sameOriginWrite (GET).
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const r = await api.listAssets();
       return Response.json(
@@ -3090,7 +3153,7 @@ export function createHttp(
       // routes (dual-allowlist, DDR-054). Loopback-Host gated (DNS-rebinding);
       // read-only, so no sameOriginWrite (GET).
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const r = await api.listStickers();
       return Response.json(
@@ -3107,7 +3170,7 @@ export function createHttp(
       // from CANVAS_SAFE_API + startCanvasServer routes (dual-allowlist, DDR-054);
       // loopback-Host gated (DNS-rebinding); no sameOriginWrite (GET).
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const url = new URL(req.url);
       const result = await api.editScopeOp({
@@ -3131,7 +3194,7 @@ export function createHttp(
       // CANVAS_SAFE_API + startCanvasServer routes (DDR-054); loopback-Host
       // gated; no sameOriginWrite (GET).
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const url = new URL(req.url);
       const result = await api.componentMapOp({
@@ -3155,7 +3218,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3187,7 +3250,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3218,7 +3281,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3252,7 +3315,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3282,7 +3345,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3313,7 +3376,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3342,7 +3405,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ canvas?: unknown; artboardId?: unknown }>(req, 8 * 1024);
       if (!body) return new Response('body required', { status: 400 });
@@ -3410,7 +3473,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const kind = (req.headers.get('x-import-kind') || 'svg').toLowerCase();
       if (kind !== 'svg') {
@@ -3477,7 +3540,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       let body: { assetPath?: unknown };
       try {
@@ -3551,7 +3614,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         format?: unknown;
@@ -3595,7 +3658,7 @@ export function createHttp(
       // /_api/export today — DDR-060). loopback-Host gated on every method;
       // the mutating POST is additionally sameOriginWrite CSRF gated (same
       // /flow:done security fan-out fix as /_api/export above).
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         return Response.json(
@@ -3643,7 +3706,7 @@ export function createHttp(
       // unguessable job-scoped UUID plus this guard closes the DNS-rebinding
       // angle the /flow:done security fan-out checked for).
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const id = new URL(req.url).searchParams.get('id');
       if (!id) return new Response('id query param required', { status: 400 });
@@ -3671,7 +3734,7 @@ export function createHttp(
     // loopback-Host gated on every method; the mutating POST is additionally
     // sameOriginWrite CSRF-gated. See DDR-16x + the canvas-origin-gate test.
     '/_api/generate-jobs': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         return Response.json(
@@ -3790,7 +3853,7 @@ export function createHttp(
     // keyUrl) + presence-only `configured` flags. NO secret ever crosses here.
     // MAIN-ORIGIN ONLY, loopback-gated.
     '/_api/generate/providers': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       const configured = new Set(configuredProviders());
@@ -3807,7 +3870,7 @@ export function createHttp(
     // ({configured:[...]}) — a key value is NEVER echoed back (mirrors
     // github_is_signed_in). MAIN-ORIGIN ONLY, loopback + sameOriginWrite gated.
     '/_api/generate/keys': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         return Response.json(
@@ -3851,7 +3914,7 @@ export function createHttp(
     // ONLY, loopback + sameOriginWrite gated. NEVER touches a key — that's the
     // separate /_api/generate/keys route.
     '/_api/generate/prefs': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         return Response.json(
@@ -3884,7 +3947,7 @@ export function createHttp(
         }
         const provider = body?.transcriptionProvider;
         if (!isTranscriptionProvider(provider))
-          return new Response('transcriptionProvider must be whisper|elevenlabs|groq', {
+          return new Response('transcriptionProvider must be auto|whisper|elevenlabs|groq', {
             status: 400,
           });
         await writeTranscriptionProvider(ctx.paths.repoRoot, provider);
@@ -3906,7 +3969,7 @@ export function createHttp(
     // prefs; POST merge-patches only the provided keys. MAIN-ORIGIN ONLY, loopback
     // + sameOriginWrite gated (never reachable from the untrusted canvas origin).
     '/_api/ui-prefs': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         return Response.json(readUiPrefs(), { headers: { 'Cache-Control': 'no-store' } });
@@ -3963,7 +4026,7 @@ export function createHttp(
     // already paid), returning ranked reuse candidates. MAIN-ORIGIN ONLY,
     // loopback-gated (it resolves the provider key server-side).
     '/_api/generate/audio-search': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       // F1 (ethical-hacker) — this GET resolves the user's key + fans out to the
@@ -4011,7 +4074,7 @@ export function createHttp(
     // reused track is itself searchable. MAIN-ORIGIN ONLY, loopback +
     // sameOriginWrite gated.
     '/_api/generate/audio-reuse': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
@@ -4051,11 +4114,21 @@ export function createHttp(
     // `maude design transcribe --provider whisper` auto-resolves it. MAIN-ORIGIN
     // ONLY, loopback + sameOriginWrite gated.
     '/_api/generate/whisper-model': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
+        // `setup` tells the card whether the ENGINE is actually installed and
+        // how to get it on THIS machine (no `brew install` without Homebrew);
+        // `auto` reports what the automatic engine choice currently resolves
+        // to, so the card can state it out loud rather than switch silently.
+        const setup = whisperSetup();
         return Response.json(
-          { models: listWhisperModels(), downloading: whisperDownload },
+          {
+            models: listWhisperModels(),
+            downloading: whisperDownload,
+            setup,
+            auto: resolveAutoEngine(configuredProviders(), setup.installed),
+          },
           { headers: { 'Cache-Control': 'no-store' } }
         );
       }
@@ -4114,7 +4187,7 @@ export function createHttp(
     // which tier will run; POST {id} downloads one via huggingface_hub (gated on
     // mlx-vlm being installed — the model is useless without it). MAIN-ORIGIN ONLY.
     '/_api/generate/keyframe-model': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         // The GET builds availability by spawning subprocesses (import mlx_vlm is
@@ -4124,12 +4197,28 @@ export function createHttp(
         // are also TTL-cached in gemma-models.ts as defence-in-depth.
         if (!sameOriginRead(req))
           return new Response('cross-origin read rejected', { status: 403 });
+        const ollama = await ollamaStatus();
         return Response.json(
           {
-            models: listGemmaModels(),
+            // Both runtimes' models in one list, each tagged with the runtime
+            // it needs — the card enables the button for whichever runtime this
+            // machine actually has, instead of a dead "Needs mlx-vlm".
+            models: listScoutModels(ollama),
             downloading: keyframeDownload,
             mlxVlmAvailable: mlxVlmAvailable(),
             ffmpegAvailable: ffmpegAvailable(),
+            // Setup routes that actually work on THIS machine, best first — no
+            // `brew install` without Homebrew, no venv one-liner without
+            // python3, and "start it" rather than "install it" when the binary
+            // is already there. Computed from the SAME paths the probes check,
+            // so the shown command and the detection can't drift.
+            mlx: mlxSetup(),
+            ollama: {
+              ...ollama,
+              recommendedModel: OLLAMA_RECOMMENDED_MODEL,
+              pullCommand: `ollama pull ${OLLAMA_RECOMMENDED_MODEL}`,
+              setup: ollamaSetupOptions(ollama),
+            },
           },
           { headers: { 'Cache-Control': 'no-store' } }
         );
@@ -4145,23 +4234,34 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!mlxVlmAvailable())
+      const body = await readJson<{ id?: unknown }>(req, 4 * 1024);
+      const id = typeof body?.id === 'string' ? body.id : '';
+      // One route, two runtimes: an `ollama:` id pulls through the local Ollama
+      // server, anything else is an mlx HF snapshot. Each gates on ITS OWN
+      // runtime — an Ollama user must not be blocked by a missing mlx-vlm.
+      const isOllama = Boolean(getOllamaModel(id));
+      if (!isOllama && !listGemmaModels().some((m) => m.id === id))
+        return new Response('unknown model id', { status: 400 });
+      if (isOllama) {
+        const status = await ollamaStatus();
+        if (!status.available)
+          return new Response('Ollama is not running — start it (`ollama serve`) and try again.', {
+            status: 400,
+          });
+      } else if (!mlxVlmAvailable())
         return new Response(
-          'mlx-vlm not installed — the Gemma scout needs an Apple-Silicon Mac + `pip install mlx-vlm`.',
+          'mlx-vlm not installed — run the install command shown in Settings → Video. (Ollama users don’t need this download: `ollama pull` fetches its own models.)',
           {
             status: 400,
           }
         );
-      const body = await readJson<{ id?: unknown }>(req, 4 * 1024);
-      const id = typeof body?.id === 'string' ? body.id : '';
-      if (!listGemmaModels().some((m) => m.id === id))
-        return new Response('unknown model id', { status: 400 });
       if (keyframeDownload && !keyframeDownload.error)
         return new Response(`a download is already in progress (${keyframeDownload.id})`, {
           status: 409,
         });
       keyframeDownload = { id, received: 0, total: 0 };
-      void downloadGemmaModel(
+      const run = isOllama ? pullOllamaModel : downloadGemmaModel;
+      void run(
         id,
         (received, total) => {
           if (keyframeDownload && keyframeDownload.id === id) {
@@ -4199,7 +4299,7 @@ export function createHttp(
       // dataURLs of local footage → disclosure) or WRITE arbitrary JSON later
       // rendered as <img src> in the trusted shell. The loopback-host check is
       // the same backstop every sibling privileged route carries.
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const url = new URL(req.url);
       const key = url.searchParams.get('key') ?? '';