@1agh/maude 0.55.0 → 0.57.0

package/apps/studio/http.ts

@@ -17,7 +17,14 @@ import {
   startSignin,
 } from './acp/login-state.ts';
 import { probeAcpAvailabilityAuthed } from './acp/probe.ts';
-import { deleteChat, listChats, readChatMessages, writeChatMeta } from './acp/transcript.ts';
+import { activitySnapshot, runningChats } from './acp/running.ts';
+import {
+  chatTranscriptSeq,
+  deleteChat,
+  listChats,
+  readChatMessages,
+  writeChatMeta,
+} from './acp/transcript.ts';
 import { type Api, ASSET_MAX_BYTES, ASSET_MAX_VIDEO_BYTES } from './api.ts';
 import { ImportAssetError, importSvg, SVG_MAX_BYTES } from './bin/_import-asset.mjs';
 import { ImportBrandError, importBrand } from './bin/_import-brand.mjs';
@@ -46,8 +53,15 @@ import { localizeGenAsset } from './generation/download.ts';
 import {
   downloadGemmaModel,
   ffmpegAvailable,
+  getOllamaModel,
   listGemmaModels,
+  listScoutModels,
+  mlxSetup,
   mlxVlmAvailable,
+  OLLAMA_RECOMMENDED_MODEL,
+  ollamaSetupOptions,
+  ollamaStatus,
+  pullOllamaModel,
 } from './generation/gemma-models.ts';
 import { type GenerationJobQueue, GenerationQueueFullError } from './generation/jobs.ts';
 import {
@@ -77,6 +91,8 @@ import {
   getWhisperModel,
   listWhisperModels,
   removeWhisperModel,
+  resolveAutoEngine,
+  whisperSetup,
 } from './generation/whisper-models.ts';
 import { createGitEndpoints } from './git/endpoints.ts';
 import { gitShowFile } from './git/service.ts';
@@ -289,12 +305,53 @@ export function sameOriginWrite(req: Request): boolean {
   const origin = req.headers.get('origin');
   if (!origin) return true; // non-browser / same-origin omitting Origin → allow
   try {
-    return origin === new URL(req.url).origin;
+    // HOSTS, not full origins — the same reason isOwnShellOrigin (studio-proxy)
+    // compares host-only for the collab WS upgrade. In a cell, TLS terminates at
+    // the proxy, so the browser's `https://<host>` Origin reaches a studio that
+    // serves plaintext and computes `req.url` as `http://<host>`; a full-origin
+    // compare then rejects every legitimate shell write on the SCHEME alone
+    // (403 "cross-origin write rejected" — the second half of the inspector-edits
+    // RCA, found when the loopback fix uncovered it). Host+port still pins the
+    // origin: the port rides in `host`, and scheme was never the CSRF
+    // discriminator here — locally everything is http, and a real cross-site page
+    // has a different host.
+    return new URL(origin).host === new URL(req.url).host;
   } catch {
     return false;
   }
 }
 
+/**
+ * The DNS-rebind guard, mode-aware — Cloud Phase 27, the inspector-edits RCA
+ * (`issue-cloud-inspector-edits-refused-by-loopback-guard`).
+ *
+ * `isLoopbackHost(req.headers.get('host'))` is right on a laptop: a malicious
+ * page that resolves `evil.com` → 127.0.0.1 makes the browser send a FOREIGN
+ * Host to the locally-bound dev server, and the guard rejects it. In a CELL that
+ * same check can NEVER pass — the hub's authenticating proxy rewrites Host to the
+ * project's public name (D4, `upstreamHeaders`) on purpose — so every shell edit
+ * (Inspector CSS, artboard ops, insert/delete/reorder, edit-attr/text) 403'd
+ * with "local request required (DNS-rebinding guard)". Annotations and comments
+ * were spared only because their handlers carry no such guard; that split of
+ * which routes worked was exactly the fingerprint of this bug.
+ *
+ * The cell doesn't NEED the Host check: the proxy already terminated the session,
+ * authorized it against the one role table (studio-manifest's `decide()`), and
+ * injects `x-maude-role` after stripping every inbound `x-maude-*` — so the
+ * header's PRESENCE is unforgeable proof the request came through the hub. Same
+ * `WORKSPACE ? x-maude-role` vouch the collab-WS upgrade already trusts
+ * (server.ts, RCA issue-cloud-live-collaboration-dead). Outside workspace mode
+ * this is the loopback check, verbatim.
+ *
+ * Safe against secret leakage by construction: a cell PRUNES every secret-bearing
+ * route family out of its table (`pruneForWorkspace` + the boot-assert), so the
+ * vouched path can only ever reach the project-editing surfaces that survive.
+ */
+export function isTrustedRequestHost(req: Request): boolean {
+  if (isLoopbackHost(req.headers.get('host'))) return true;
+  return isWorkspaceMode() && !!req.headers.get('x-maude-role');
+}
+
 /**
  * CSRF guard for a key-bearing / side-effecting GET (Task 2.5 audio-search —
  * ethical-hacker F1). A cross-site page can issue a `no-cors` GET to
@@ -1137,7 +1194,7 @@ export function createHttp(
     // but newly worth closing given what this diff makes it able to reveal.
     '/_api/acp/status': async (req: Request) => {
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       return Response.json(await probeAcpAvailabilityAuthed(), {
         headers: { 'Cache-Control': 'no-store' },
@@ -1155,7 +1212,7 @@ export function createHttp(
     // ChatPanel not-connected explainer + the Help-menu modal read this.
     '/_api/preflight': async (req: Request) => {
       if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       return Response.json(await probeReadiness(), { headers: { 'Cache-Control': 'no-store' } });
     },
@@ -1169,7 +1226,7 @@ export function createHttp(
     // (SetupChecklist.jsx) polls this.
     '/_api/setup-readiness': async (req: Request) => {
       if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       return Response.json(await probeSetupReadiness(ctx), {
         headers: { 'Cache-Control': 'no-store' },
@@ -1185,7 +1242,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       // Fire-and-forget — the install can run past Bun's default 10s idle
       // timeout on a slow network, so this returns as soon as the spawn is
@@ -1206,7 +1263,7 @@ export function createHttp(
     // two routes, which used the wrong guard.
     '/_api/claude/install-status': (req: Request) => {
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       return Response.json(getInstallState(), { headers: { 'Cache-Control': 'no-store' } });
     },
@@ -1223,7 +1280,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const result = startSignin();
       return Response.json(result, {
@@ -1235,7 +1292,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       cancelSignin();
       return Response.json({ ok: true }, { headers: { 'Cache-Control': 'no-store' } });
@@ -1245,7 +1302,7 @@ export function createHttp(
     // Narrowed fields only (never email/orgId/orgName — see login-state.ts).
     '/_api/claude/signin-status': async (req: Request) => {
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const status = await getClaudeAuthStatus();
       return Response.json(
@@ -1263,12 +1320,46 @@ export function createHttp(
       // chat-open` driver omits Origin (allowed); a browser drive-by can't forge it.
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       ctx.bus.emit('acp-focus', {});
       return Response.json({ ok: true }, { headers: { 'Cache-Control': 'no-store' } });
     },
 
+    // Addendum Task 9 — "is a chat mid-turn right now?", asked by
+    // RepoBranchSwitcher.jsx before any of its three `window.location.reload()`
+    // call sites. A `git checkout` moves the worktree under a running agent
+    // (read on `draft-a`, written back after the checkout to `main` — a silent
+    // cross-branch clobber that `_history/`, being per-canvas-slug with no
+    // branch awareness, cannot undo), so this gates a confirm rather than
+    // reloading silently. MAIN-ORIGIN ONLY, read-only, no chat CONTENT — just
+    // how many are busy, so it says nothing the canvas origin could want.
+    '/_api/acp/running': (req: Request) => {
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const running = runningChats();
+      return Response.json(
+        { running: running.length, chats: running },
+        { headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    // feature-acp-turn-notifications Task 3 — the native shell's poller reads
+    // this to decide whether to fire an OS notification for a NON-visible
+    // project (Decision C). A sibling of `/_api/acp/running` above rather than
+    // an extension of it — that route stays exactly as-is because the reaper's
+    // `has_running_chat` (sidecar.rs) already depends on its `{running,chats}`
+    // shape and has no reason to grow one. MAIN-ORIGIN ONLY, same gate, and —
+    // load-bearing (Decision D) — NEVER a chat title, message text, or any
+    // transcript content: just chat ids (opaque, already exposed by `running`
+    // above) and a three-value state. Anyone adding a field here should ask
+    // what it would look like rendered on a lock screen.
+    '/_api/acp/activity': (req: Request) => {
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      return Response.json(activitySnapshot(), { headers: { 'Cache-Control': 'no-store' } });
+    },
+
     // Phase 31 — repo-level chat list + history (for the chat switcher +
     // hydration). MAIN-ORIGIN ONLY. Read-only; ids are sanitized before disk.
     '/_api/acp/chats': () =>
@@ -1289,7 +1380,7 @@ export function createHttp(
       if (req.method === 'PATCH') {
         if (!sameOriginWrite(req))
           return new Response('cross-origin write rejected', { status: 403 });
-        if (!isLoopbackHost(req.headers.get('host')))
+        if (!isTrustedRequestHost(req))
           return new Response('local request required (DNS-rebinding guard)', { status: 403 });
         if (!id) return new Response('missing id', { status: 400 });
         let body: unknown;
@@ -1315,8 +1406,16 @@ export function createHttp(
         return Response.json(meta, { headers: { 'Cache-Control': 'no-store' } });
       }
       if (!id) return Response.json([], { headers: { 'Cache-Control': 'no-store' } });
+      // Addendum Task 8 — the re-attach seam. Read the sequence marker BEFORE
+      // the messages: a line appended between the two reads then shows up in
+      // neither, and the client's `attach` will replay it. Reading it after
+      // would risk the opposite (a line counted but not returned), which the
+      // client would silently drop as "already hydrated" — a hole in the feed.
+      // Shipped as a header rather than a body field so the response SHAPE
+      // stays the plain message array every existing consumer expects.
+      const seq = chatTranscriptSeq(ctx.paths.designRoot, id);
       return Response.json(readChatMessages(ctx.paths.designRoot, id), {
-        headers: { 'Cache-Control': 'no-store' },
+        headers: { 'Cache-Control': 'no-store', 'X-Maude-Chat-Seq': String(seq) },
       });
     },
 
@@ -1350,7 +1449,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const declared = Number(req.headers.get('content-length') || '0');
       if (Number.isFinite(declared) && declared > ASSET_MAX_BYTES) {
@@ -1457,7 +1556,7 @@ export function createHttp(
     // /_api/acp/status (a drive-by page must not read logs via DNS rebinding).
     '/_api/debug-bundle': (req: Request) => {
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       return Response.json(
         buildDebugBundle({
@@ -1490,7 +1589,7 @@ export function createHttp(
     '/_api/shell-shot': async (req: Request) => {
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       // Target the very server handling this request — no _server.json read, so
       // a stale/absent state file can't point the capture at another instance.
@@ -1560,7 +1659,7 @@ export function createHttp(
     '/_api/report': async (req: Request) => {
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const endpoint = process.env.MAUDE_REPORT_URL || 'https://cloud.maude.sh/report';
       try {
@@ -1593,7 +1692,7 @@ export function createHttp(
     '/_api/report-fallback': async (req: Request) => {
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ report?: unknown; screenshots?: unknown }>(req);
       if (!body || typeof body.report !== 'object' || body.report === null) {
@@ -1694,7 +1793,7 @@ export function createHttp(
       // the photo-store cap stack (sha8 validate + containment + validatePhotoEdit
       // + size cap) is the load-bearing mitigation. loopback-Host gates DNS-
       // rebinding on every method.
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const asset = new URL(req.url).searchParams.get('asset');
       if (req.method === 'GET') {
@@ -1732,7 +1831,7 @@ export function createHttp(
       // DNS-rebinding on every method; the footage-store cap stack (sha8/slug
       // validate + containment + validate{FootageAnalysis,Edl} + size cap) is the
       // load-bearing mitigation for the caller-derived write path.
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const params = new URL(req.url).searchParams;
       const asset = params.get('asset');
@@ -1775,7 +1874,7 @@ export function createHttp(
       // a rebound page shares this origin; the dev-server always binds 127.0.0.1,
       // so a real browser (Host: localhost:<port>) passes and only a rebound
       // foreign hostname 403s. (No sameOriginWrite here — GET.)
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const file = new URL(req.url).searchParams.get('file');
       const r = await api.loadCanvasSource(file);
@@ -1840,7 +1939,7 @@ export function createHttp(
       // slash-command driver omits Origin (→ allowed); a browser drive-by can't.
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ file?: string; author?: string }>(req);
       if (!body || typeof body.file !== 'string' || !body.file.trim()) {
@@ -1860,7 +1959,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ file?: string }>(req);
       if (!body || typeof body.file !== 'string' || !body.file.trim()) {
@@ -1876,7 +1975,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ file?: string }>(req);
       if (!body || typeof body.file !== 'string' || !body.file.trim()) {
@@ -1937,7 +2036,7 @@ export function createHttp(
       if (req.method === 'DELETE' || req.method === 'POST') {
         if (!sameOriginWrite(req))
           return new Response('cross-origin write rejected', { status: 403 });
-        if (!isLoopbackHost(req.headers.get('host')))
+        if (!isTrustedRequestHost(req))
           return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       }
       if (req.method === 'DELETE') {
@@ -2000,7 +2099,7 @@ export function createHttp(
     '/_api/fs-move': async (req: Request) => {
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       const body = await readJson<{ file?: unknown; toDir?: unknown }>(req, 4 * 1024);
@@ -2031,7 +2130,7 @@ export function createHttp(
     '/_api/fs-mkdir': async (req: Request) => {
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       const body = await readJson<{ parent?: unknown; name?: unknown }>(req, 4 * 1024);
@@ -2092,7 +2191,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.createBranch(body));
@@ -2102,7 +2201,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.checkout(body));
@@ -2114,7 +2213,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('adding a draft requires a local request', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.fold(body));
@@ -2126,7 +2225,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('refresh requires a local request', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.fetchRemote(body));
@@ -2136,7 +2235,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<unknown>(req, 256 * 1024);
       return gitJson(await gitApi.commit(body));
@@ -2146,7 +2245,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<unknown>(req, 256 * 1024);
       return gitJson(await gitApi.discard(body));
@@ -2156,11 +2255,11 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       // Token-bearing: refuse anything not from a loopback Host (the server binds
       // 127.0.0.1, so this is belt-and-suspenders against a forwarded/rebound Host).
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('publish requires a local request', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.push(body));
@@ -2170,7 +2269,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('get latest requires a local request', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.pull(body));
@@ -2184,7 +2283,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('resolve requires a local request', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.resolve(body));
@@ -2205,7 +2304,7 @@ export function createHttp(
       // whose 401 DELETES the stored credential — a confused deputy worth
       // closing (validate 2026-07-30, defender F6).
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(cloudApi.status());
     },
@@ -2213,7 +2312,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(await cloudApi.signinStart());
     },
@@ -2221,7 +2320,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = (await req.json().catch(() => ({}))) as { deviceCode?: string };
       return gitJson(await cloudApi.signinPoll(String(body.deviceCode ?? '')));
@@ -2230,14 +2329,14 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(cloudApi.signout());
     },
     '/_api/cloud/projects': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(await cloudApi.projects());
     },
@@ -2245,7 +2344,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = (await req.json().catch(() => ({}))) as { project?: string };
       return gitJson(await cloudApi.attach(String(body.project ?? '')));
@@ -2257,7 +2356,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = (await req.json().catch(() => ({}))) as { code?: string; project?: string };
       return gitJson(
@@ -2270,14 +2369,14 @@ export function createHttp(
 
     '/_api/github/identity': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(await githubApi.identity());
     },
 
     '/_api/github/repos': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       return gitJson(await githubApi.repos());
     },
@@ -2286,7 +2385,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.createRepo(body));
@@ -2296,7 +2395,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.invite(body));
@@ -2306,7 +2405,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.clone(body));
@@ -2316,7 +2415,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.createProject(body));
@@ -2331,7 +2430,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.createLocalProject(body));
@@ -2344,7 +2443,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await githubApi.initDesign(body));
@@ -2359,7 +2458,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await linkHub(body));
@@ -2374,7 +2473,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const body = await readJson<unknown>(req, 8 * 1024);
       const result = await signInToWorkspace((body ?? {}) as Record<string, unknown>);
@@ -2390,7 +2489,7 @@ export function createHttp(
     // for, and every route the canvas can reach is one more thing to reason about.
     '/_api/workspace/disclosure': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required', { status: 403 });
       const url = new URL(req.url);
       const linked = ctx.cfg.linkedHub?.url ?? null;
@@ -2420,7 +2519,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2453,7 +2552,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2486,7 +2585,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2522,7 +2621,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2562,7 +2661,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2598,7 +2697,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2643,7 +2742,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2673,7 +2772,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2710,7 +2809,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2743,7 +2842,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2774,7 +2873,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2808,7 +2907,7 @@ export function createHttp(
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       // DNS-rebinding guard — this GET echoes project source structure; loopback-
       // only Host (real browser passes, rebound hostname 403s). No sameOriginWrite (GET).
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const u = new URL(req.url);
       const result = await api.compClips({
@@ -2834,7 +2933,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ canvas?: unknown; seq?: unknown; dir?: unknown }>(
         req,
@@ -2865,7 +2964,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ canvas?: unknown; id?: unknown; idIndex?: unknown }>(
         req,
@@ -2897,7 +2996,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2932,7 +3031,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -2966,7 +3065,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ canvas?: unknown; id?: unknown; idIndex?: unknown }>(
         req,
@@ -2993,7 +3092,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ canvas?: unknown; id?: unknown; idIndex?: unknown }>(
         req,
@@ -3022,7 +3121,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3056,7 +3155,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3085,7 +3184,7 @@ export function createHttp(
       // + startCanvasServer routes (dual-allowlist, DDR-054). Loopback-Host gated
       // (DNS-rebinding); read-only, so no sameOriginWrite (GET).
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const r = await api.listAssets();
       return Response.json(
@@ -3103,7 +3202,7 @@ export function createHttp(
       // routes (dual-allowlist, DDR-054). Loopback-Host gated (DNS-rebinding);
       // read-only, so no sameOriginWrite (GET).
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const r = await api.listStickers();
       return Response.json(
@@ -3120,7 +3219,7 @@ export function createHttp(
       // from CANVAS_SAFE_API + startCanvasServer routes (dual-allowlist, DDR-054);
       // loopback-Host gated (DNS-rebinding); no sameOriginWrite (GET).
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const url = new URL(req.url);
       const result = await api.editScopeOp({
@@ -3144,7 +3243,7 @@ export function createHttp(
       // CANVAS_SAFE_API + startCanvasServer routes (DDR-054); loopback-Host
       // gated; no sameOriginWrite (GET).
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const url = new URL(req.url);
       const result = await api.componentMapOp({
@@ -3168,7 +3267,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3200,7 +3299,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3231,7 +3330,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3265,7 +3364,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3295,7 +3394,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3326,7 +3425,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         canvas?: unknown;
@@ -3355,7 +3454,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{ canvas?: unknown; artboardId?: unknown }>(req, 8 * 1024);
       if (!body) return new Response('body required', { status: 400 });
@@ -3423,7 +3522,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const kind = (req.headers.get('x-import-kind') || 'svg').toLowerCase();
       if (kind !== 'svg') {
@@ -3490,7 +3589,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       let body: { assetPath?: unknown };
       try {
@@ -3564,7 +3663,7 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         format?: unknown;
@@ -3608,7 +3707,7 @@ export function createHttp(
       // /_api/export today — DDR-060). loopback-Host gated on every method;
       // the mutating POST is additionally sameOriginWrite CSRF gated (same
       // /flow:done security fan-out fix as /_api/export above).
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         return Response.json(
@@ -3656,7 +3755,7 @@ export function createHttp(
       // unguessable job-scoped UUID plus this guard closes the DNS-rebinding
       // angle the /flow:done security fan-out checked for).
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const id = new URL(req.url).searchParams.get('id');
       if (!id) return new Response('id query param required', { status: 400 });
@@ -3684,7 +3783,7 @@ export function createHttp(
     // loopback-Host gated on every method; the mutating POST is additionally
     // sameOriginWrite CSRF-gated. See DDR-16x + the canvas-origin-gate test.
     '/_api/generate-jobs': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         return Response.json(
@@ -3803,7 +3902,7 @@ export function createHttp(
     // keyUrl) + presence-only `configured` flags. NO secret ever crosses here.
     // MAIN-ORIGIN ONLY, loopback-gated.
     '/_api/generate/providers': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       const configured = new Set(configuredProviders());
@@ -3820,7 +3919,7 @@ export function createHttp(
     // ({configured:[...]}) — a key value is NEVER echoed back (mirrors
     // github_is_signed_in). MAIN-ORIGIN ONLY, loopback + sameOriginWrite gated.
     '/_api/generate/keys': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         return Response.json(
@@ -3864,7 +3963,7 @@ export function createHttp(
     // ONLY, loopback + sameOriginWrite gated. NEVER touches a key — that's the
     // separate /_api/generate/keys route.
     '/_api/generate/prefs': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         return Response.json(
@@ -3897,7 +3996,7 @@ export function createHttp(
         }
         const provider = body?.transcriptionProvider;
         if (!isTranscriptionProvider(provider))
-          return new Response('transcriptionProvider must be whisper|elevenlabs|groq', {
+          return new Response('transcriptionProvider must be auto|whisper|elevenlabs|groq', {
             status: 400,
           });
         await writeTranscriptionProvider(ctx.paths.repoRoot, provider);
@@ -3919,7 +4018,7 @@ export function createHttp(
     // prefs; POST merge-patches only the provided keys. MAIN-ORIGIN ONLY, loopback
     // + sameOriginWrite gated (never reachable from the untrusted canvas origin).
     '/_api/ui-prefs': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         return Response.json(readUiPrefs(), { headers: { 'Cache-Control': 'no-store' } });
@@ -3976,7 +4075,7 @@ export function createHttp(
     // already paid), returning ranked reuse candidates. MAIN-ORIGIN ONLY,
     // loopback-gated (it resolves the provider key server-side).
     '/_api/generate/audio-search': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       // F1 (ethical-hacker) — this GET resolves the user's key + fans out to the
@@ -4024,7 +4123,7 @@ export function createHttp(
     // reused track is itself searchable. MAIN-ORIGIN ONLY, loopback +
     // sameOriginWrite gated.
     '/_api/generate/audio-reuse': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
@@ -4064,11 +4163,21 @@ export function createHttp(
     // `maude design transcribe --provider whisper` auto-resolves it. MAIN-ORIGIN
     // ONLY, loopback + sameOriginWrite gated.
     '/_api/generate/whisper-model': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
+        // `setup` tells the card whether the ENGINE is actually installed and
+        // how to get it on THIS machine (no `brew install` without Homebrew);
+        // `auto` reports what the automatic engine choice currently resolves
+        // to, so the card can state it out loud rather than switch silently.
+        const setup = whisperSetup();
         return Response.json(
-          { models: listWhisperModels(), downloading: whisperDownload },
+          {
+            models: listWhisperModels(),
+            downloading: whisperDownload,
+            setup,
+            auto: resolveAutoEngine(configuredProviders(), setup.installed),
+          },
           { headers: { 'Cache-Control': 'no-store' } }
         );
       }
@@ -4127,7 +4236,7 @@ export function createHttp(
     // which tier will run; POST {id} downloads one via huggingface_hub (gated on
     // mlx-vlm being installed — the model is useless without it). MAIN-ORIGIN ONLY.
     '/_api/generate/keyframe-model': async (req: Request) => {
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         // The GET builds availability by spawning subprocesses (import mlx_vlm is
@@ -4137,12 +4246,28 @@ export function createHttp(
         // are also TTL-cached in gemma-models.ts as defence-in-depth.
         if (!sameOriginRead(req))
           return new Response('cross-origin read rejected', { status: 403 });
+        const ollama = await ollamaStatus();
         return Response.json(
           {
-            models: listGemmaModels(),
+            // Both runtimes' models in one list, each tagged with the runtime
+            // it needs — the card enables the button for whichever runtime this
+            // machine actually has, instead of a dead "Needs mlx-vlm".
+            models: listScoutModels(ollama),
             downloading: keyframeDownload,
             mlxVlmAvailable: mlxVlmAvailable(),
             ffmpegAvailable: ffmpegAvailable(),
+            // Setup routes that actually work on THIS machine, best first — no
+            // `brew install` without Homebrew, no venv one-liner without
+            // python3, and "start it" rather than "install it" when the binary
+            // is already there. Computed from the SAME paths the probes check,
+            // so the shown command and the detection can't drift.
+            mlx: mlxSetup(),
+            ollama: {
+              ...ollama,
+              recommendedModel: OLLAMA_RECOMMENDED_MODEL,
+              pullCommand: `ollama pull ${OLLAMA_RECOMMENDED_MODEL}`,
+              setup: ollamaSetupOptions(ollama),
+            },
           },
           { headers: { 'Cache-Control': 'no-store' } }
         );
@@ -4158,23 +4283,34 @@ export function createHttp(
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      if (!mlxVlmAvailable())
+      const body = await readJson<{ id?: unknown }>(req, 4 * 1024);
+      const id = typeof body?.id === 'string' ? body.id : '';
+      // One route, two runtimes: an `ollama:` id pulls through the local Ollama
+      // server, anything else is an mlx HF snapshot. Each gates on ITS OWN
+      // runtime — an Ollama user must not be blocked by a missing mlx-vlm.
+      const isOllama = Boolean(getOllamaModel(id));
+      if (!isOllama && !listGemmaModels().some((m) => m.id === id))
+        return new Response('unknown model id', { status: 400 });
+      if (isOllama) {
+        const status = await ollamaStatus();
+        if (!status.available)
+          return new Response('Ollama is not running — start it (`ollama serve`) and try again.', {
+            status: 400,
+          });
+      } else if (!mlxVlmAvailable())
         return new Response(
-          'mlx-vlm not installed — the Gemma scout needs an Apple-Silicon Mac + `pip install mlx-vlm`.',
+          'mlx-vlm not installed — run the install command shown in Settings → Video. (Ollama users don’t need this download: `ollama pull` fetches its own models.)',
           {
             status: 400,
           }
         );
-      const body = await readJson<{ id?: unknown }>(req, 4 * 1024);
-      const id = typeof body?.id === 'string' ? body.id : '';
-      if (!listGemmaModels().some((m) => m.id === id))
-        return new Response('unknown model id', { status: 400 });
       if (keyframeDownload && !keyframeDownload.error)
         return new Response(`a download is already in progress (${keyframeDownload.id})`, {
           status: 409,
         });
       keyframeDownload = { id, received: 0, total: 0 };
-      void downloadGemmaModel(
+      const run = isOllama ? pullOllamaModel : downloadGemmaModel;
+      void run(
         id,
         (received, total) => {
           if (keyframeDownload && keyframeDownload.id === id) {
@@ -4212,7 +4348,7 @@ export function createHttp(
       // dataURLs of local footage → disclosure) or WRITE arbitrary JSON later
       // rendered as <img src> in the trusted shell. The loopback-host check is
       // the same backstop every sibling privileged route carries.
-      if (!isLoopbackHost(req.headers.get('host')))
+      if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const url = new URL(req.url);
       const key = url.searchParams.get('key') ?? '';