@inerrata-corporation/errata 2.0.22-dev.4074 → 2.0.22-dev.4121

package/errata.mjs

@@ -85053,7 +85053,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.22-dev.4074" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.22-dev.4121" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -87723,6 +87723,39 @@ B: ${b}`,
   };
 }
 
+// src/loopback-guard.ts
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
+function isLoopbackHost(host) {
+  const h = host.trim().toLowerCase();
+  const m = /^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(h);
+  return !!m && LOOPBACK_HOSTNAMES.has(m[1]);
+}
+function isLoopbackOrigin(origin) {
+  try {
+    const u = new URL(origin);
+    return u.protocol === "http:" && LOOPBACK_HOSTNAMES.has(u.hostname);
+  } catch {
+    return false;
+  }
+}
+function loopbackRefusal(headers) {
+  const host = headers.get("host");
+  if (host !== null && host !== "" && !isLoopbackHost(host)) return "non-loopback Host";
+  const origin = headers.get("origin");
+  if (origin !== null && !isLoopbackOrigin(origin)) return "non-loopback Origin";
+  return null;
+}
+function withLoopbackGuard(fetchFn) {
+  return (req) => {
+    const refusal = loopbackRefusal(req.headers);
+    if (refusal) return new Response(JSON.stringify({ error: "forbidden", reason: refusal }), {
+      status: 403,
+      headers: { "content-type": "application/json" }
+    });
+    return fetchFn(req);
+  };
+}
+
 // src/daemon.ts
 async function startDaemon(opts) {
   const processStartedAt = Date.now();
@@ -87804,7 +87837,7 @@ async function startDaemon(opts) {
 }
 async function listenServer(fetchFn, port) {
   return new Promise((resolve10, reject) => {
-    const server = serve({ fetch: fetchFn, hostname: "127.0.0.1", port }, (info2) => {
+    const server = serve({ fetch: withLoopbackGuard(fetchFn), hostname: "127.0.0.1", port }, (info2) => {
       resolve10({ server, port: info2.port });
     });
     server.once(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.22-dev.4074",
+  "version": "2.0.22-dev.4121",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/resources/context-plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "errata-context",
-  "version": "2.0.22-dev.4074",
+  "version": "2.0.22-dev.4121",
   "description": "A minimal 3D view of loaded Errata priors and recent graph bursts.",
   "author": {
     "name": "inErrata"

package/resources/context-plugin/SHA256SUMS

@@ -1,4 +1,4 @@
-fe984b8b1cdd56eb598e74a61485e191c89e632163f5e27d35184130dafdb81c  .codex-plugin/plugin.json
+9f7ae426e110baef3bb27e68785897f745b77ef23fd2ee4e73188e8e6047890d  .codex-plugin/plugin.json
 a7bebae9fb01c838d6c75fc784129e28be571233fa66ff5ee8039b574f35ccf7  assets/icon.png
 fc38b64e4df1e0b72c35764bef6c4c05430d97c9009ad0ecc8a9e75b4deab232  configure-local.mjs
 73dc6028b3b070257c7c31f252d11e55a9e096f4aed0f187f10cb21716e1e6d7  dist/client.js