@aloud/runner 0.3.1 → 0.3.3

package/src/run/execute.ts

@@ -145,7 +145,7 @@ export async function executeLease(deps: ExecuteDeps): Promise<ExecuteResult> {
   const workers = new GuardedWorkerFactory(
     deps.workers ?? new PlaywrightWorkerFactory(),
     effective.allowedHosts,
-    deps.local,
+    { ...deps.local, allowPrivateNetwork: effective.allowPrivateNetwork },
   );
 
   coordinator = new RunCoordinator(

package/src/run/sanitise.ts

@@ -1,8 +1,10 @@
 import {
   evaluateTargetUrl,
+  hostPermitted,
   intersectHosts,
   leasePermits,
   normaliseHosts,
+  targetNetworkAccess,
   type JobLease,
   type StudySnapshot,
 } from "@aloud/core";
@@ -31,6 +33,8 @@ export class SnapshotRefused extends Error {
 export interface SanitisedSnapshot {
   snapshot: StudySnapshot;
   allowedHosts: string[];
+  /** False for an automatic public grant, which keeps DNS rebinding out of the local network. */
+  allowPrivateNetwork: boolean;
 }
 
 export async function sanitiseSnapshot(
@@ -44,38 +48,56 @@ export async function sanitiseSnapshot(
   const granted = normaliseHosts(lease.allowedHosts);
   const permitted = normaliseHosts(local.allowedHosts);
 
-  // The server already did this intersection. Doing it again here is the point: a server that got
-  // it wrong, or lied about it, changes nothing on this machine.
-  const effective = intersectHosts(granted, permitted);
-  if (effective.length === 0) {
-    throw new SnapshotRefused(
-      `This study wants ${granted.join(", ") || "nothing"}, and this machine allows ` +
-        `${permitted.join(", ") || "nothing"}. Nothing in common, so nothing will be opened. ` +
-        "Add a host with `aloud allow <host>` if that is wrong.",
-    );
-  }
-
   const startUrl = snapshot.study?.startUrl;
   if (typeof startUrl !== "string" || startUrl.length === 0) {
     throw new SnapshotRefused("This study has no start URL.");
   }
 
-  // Checked against the *effective* list, not the one the lease claimed.
-  const verdict = leasePermits({ ...lease, allowedHosts: effective }, startUrl, nowIso);
+  // The lease is still the outer boundary. Automatic access never invents a host the lease did not
+  // name; it only decides whether that lease host needs a durable local permission as well.
+  const verdict = leasePermits({ ...lease, allowedHosts: granted }, startUrl, nowIso);
   if (!verdict.allowed) throw new SnapshotRefused(verdict.reason);
 
+  const access = await targetNetworkAccess(startUrl, resolver);
+  if (access.kind === "blocked") throw new SnapshotRefused(access.reason);
+
+  let effective: string[];
+  let allowPrivateNetwork: boolean;
+  if (access.kind === "public") {
+    // A covering lease entry proves the start host was in scope, but the browser receives only the
+    // exact start hostname. A hostile lease cannot smuggle an unrelated domain—or a broad parent
+    // that grants sibling subdomains—into the automatic browser policy.
+    effective = granted.some((entry) => hostPermitted(access.hostname, [entry]))
+      ? [access.hostname]
+      : [];
+    allowPrivateNetwork = false;
+  } else {
+    // Private and loopback access still needs both halves of the durable permission. The server can
+    // offer it, but cannot make this intersection non-empty.
+    effective = intersectHosts(granted, permitted);
+    allowPrivateNetwork = local.allowPrivateNetwork;
+  }
+  if (effective.length === 0) {
+    throw new SnapshotRefused(
+      `This private or local study wants ${granted.join(", ") || "nothing"}, and this machine allows ` +
+        `${permitted.join(", ") || "nothing"}. Nothing in common, so nothing will be opened. ` +
+        "Add the private host with `aloud allow <host>` if that is intentional.",
+    );
+  }
+
   // And then the same check the browser worker will make, so a refusal happens before anything is
   // launched rather than three browsers in. Cloud metadata endpoints are refused unconditionally
   // in here, regardless of the private-network setting.
   const target = await evaluateTargetUrl(startUrl, {
     allowedDomains: effective,
-    allowPrivateNetwork: local.allowPrivateNetwork,
+    allowPrivateNetwork,
     ...(resolver ? { resolver } : {}),
   });
   if (!target.allowed) throw new SnapshotRefused(target.reason);
 
   return {
     allowedHosts: effective,
+    allowPrivateNetwork,
     snapshot: {
       ...snapshot,
       environment: {

package/src/ui/output.ts

@@ -39,7 +39,8 @@ export class TerminalReporter implements RunReporter {
     this.say("");
     this.say(`  Chromium          ${input.chromium ? GREEN + "ready" + RESET : YELLOW + "not installed yet" + RESET}`);
     this.say(`  Connection        ${input.server}`);
-    this.say(`  Allowed here      ${input.allowedHosts.join(", ") || "nothing yet - run `aloud allow <host>`"}`);
+    this.say(`  Public sites      ${GREEN}automatic per study${RESET}`);
+    this.say(`  Private/local     ${input.allowedHosts.join(", ") || "nothing approved"}`);
     this.say("");
   }
 

package/src/version.ts

@@ -10,7 +10,7 @@
  * package.json beside it to read, and importing one into the source trips the composite build's
  * rootDir. `version.test.ts` asserts this matches, so the drift this invites cannot survive CI.
  */
-export const RUNNER_VERSION = "0.3.1";
+export const RUNNER_VERSION = "0.3.3";
 
 /** The header the server reads it from. */
 export const RUNNER_VERSION_HEADER = "x-aloud-runner-version";