@inerrata-corporation/errata 2.0.22-dev.4074 → 2.0.22-dev.4122

package/errata.mjs

@@ -580,11 +580,20 @@ var init_graph_events = __esm({
         // silently admitted, so the next graph-health pass either gives them a
         // trigger or retires them (D12: a record nothing reads is the defect).
         prefixes: ["ingest.", "sanitize.", "queue.", "skew."],
+        keys: ["inerrata.request_id"],
         consumer: "graph-health.mjs ingest triggers (edge-reject RATE, reinforcedFraction band, the volume floor) + the 'Graph \u2014 Ingest funnel & integrity' board. queue.*/skew.* currently have NO standing consumer (found unread 2026-08-14) \u2014 trigger or retirement owed"
       },
       "graph.twin": {
         prefixes: [],
-        keys: ["rewritten", "already-generic", "rejected", "failed", "low-content", "threw", "failureFraction"],
+        keys: [
+          "rewritten",
+          "already-generic",
+          "rejected",
+          "failed",
+          "low-content",
+          "threw",
+          "failureFraction"
+        ],
         consumer: "failureFraction is the alertable number (twin-outcomes.ts); its graph-health.mjs trigger is pending a live baseline"
       },
       "graph.burst": {
@@ -85053,7 +85062,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.22-dev.4074" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.22-dev.4122" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;
@@ -87723,6 +87732,39 @@ B: ${b}`,
   };
 }
 
+// src/loopback-guard.ts
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
+function isLoopbackHost(host) {
+  const h = host.trim().toLowerCase();
+  const m = /^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(h);
+  return !!m && LOOPBACK_HOSTNAMES.has(m[1]);
+}
+function isLoopbackOrigin(origin) {
+  try {
+    const u = new URL(origin);
+    return u.protocol === "http:" && LOOPBACK_HOSTNAMES.has(u.hostname);
+  } catch {
+    return false;
+  }
+}
+function loopbackRefusal(headers) {
+  const host = headers.get("host");
+  if (host !== null && host !== "" && !isLoopbackHost(host)) return "non-loopback Host";
+  const origin = headers.get("origin");
+  if (origin !== null && !isLoopbackOrigin(origin)) return "non-loopback Origin";
+  return null;
+}
+function withLoopbackGuard(fetchFn) {
+  return (req) => {
+    const refusal = loopbackRefusal(req.headers);
+    if (refusal) return new Response(JSON.stringify({ error: "forbidden", reason: refusal }), {
+      status: 403,
+      headers: { "content-type": "application/json" }
+    });
+    return fetchFn(req);
+  };
+}
+
 // src/daemon.ts
 async function startDaemon(opts) {
   const processStartedAt = Date.now();
@@ -87804,7 +87846,7 @@ async function startDaemon(opts) {
 }
 async function listenServer(fetchFn, port) {
   return new Promise((resolve10, reject) => {
-    const server = serve({ fetch: fetchFn, hostname: "127.0.0.1", port }, (info2) => {
+    const server = serve({ fetch: withLoopbackGuard(fetchFn), hostname: "127.0.0.1", port }, (info2) => {
       resolve10({ server, port: info2.port });
     });
     server.once(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.22-dev.4074",
+  "version": "2.0.22-dev.4122",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/resources/context-plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "errata-context",
-  "version": "2.0.22-dev.4074",
+  "version": "2.0.22-dev.4122",
   "description": "A minimal 3D view of loaded Errata priors and recent graph bursts.",
   "author": {
     "name": "inErrata"

package/resources/context-plugin/SHA256SUMS

@@ -1,4 +1,4 @@
-fe984b8b1cdd56eb598e74a61485e191c89e632163f5e27d35184130dafdb81c  .codex-plugin/plugin.json
+5ba58327da38d3a9b52ab2bc97c6999d2015ca1e410205e55f10e0e24a197693  .codex-plugin/plugin.json
 a7bebae9fb01c838d6c75fc784129e28be571233fa66ff5ee8039b574f35ccf7  assets/icon.png
 fc38b64e4df1e0b72c35764bef6c4c05430d97c9009ad0ecc8a9e75b4deab232  configure-local.mjs
 73dc6028b3b070257c7c31f252d11e55a9e096f4aed0f187f10cb21716e1e6d7  dist/client.js