acrylblends 1.5.1 → 1.5.2

package/legacy/README.md

@@ -1,7 +1,7 @@
 # The scaffolds published acrylblends releases shipped
 
 Generated by `scripts/build-legacy-layouts.mjs`; do not edit by hand. Each folder is a template, each hash under it one distinct scaffold (deduplicated by
-content hash across releases), and `layouts.json` maps every published release that shipped templates (0.3.0 through 1.5.0, 46 releases)
+content hash across releases), and `layouts.json` maps every published release that shipped templates (0.3.0 through 1.5.1, 47 releases)
 to the layouts it shipped.
 
 `acrylblends upgrade` compares an app's scaffold files with these bytes: a file the app has not edited is brought up to date, an edited one is refused (or

package/legacy/layouts.json

@@ -452,6 +452,17 @@
         "notes": "fb43a1c5f3b4",
         "todo": "164274ffcf7f"
       }
+    },
+    {
+      "version": "1.5.1",
+      "layouts": {
+        "agent": "46c6eadf9230",
+        "blank": "a53d41e6ef42",
+        "chat": "d4464dfb3b04",
+        "nodejs": "a6a340b4d3a6",
+        "notes": "fb43a1c5f3b4",
+        "todo": "164274ffcf7f"
+      }
     }
   ],
   "templates": {

package/lib/cordis/door.js

@@ -1,12 +1,12 @@
 import { t as Acryl } from "../app-CQcGWjrk.js";
 import { r as streamSSE } from "../streaming-BlDaph8U.js";
-import { r as loopbackAuthority } from "../loopback-only-BbasoF7R.js";
+import { o as pageAuthority } from "../loopback-only-BoBCuDv7.js";
 import "../helpers-BEjcdbgw.js";
 import { n as clientModules } from "../client-modules-C5qiVroz.js";
 import { a as MAX_WAIT_MS, d as parseChannelToHost, l as UiControlError, p as parseUiRequest, r as MAX_SNAPSHOT_NODES, u as WINDOW_ID } from "../protocol-CQ_if7Dg.js";
-import { a as INVALID_JSON, c as operatorOnly, d as AuditLog, f as auditPath, i as DOOR_PREFIX, l as privateApi, o as error, p as UiChannel, r as pageChannelRoutes, s as jsonBody, t as renderSnapshot, u as readJson } from "../snapshot-text-CXTnjxGx.js";
+import { a as INVALID_JSON, c as operatorOnly, d as AuditLog, f as auditPath, i as DOOR_PREFIX, l as privateApi, o as error, p as UiChannel, r as pageChannelRoutes, s as jsonBody, t as renderSnapshot, u as readJson } from "../snapshot-text-B9PWQoX6.js";
 import "../src-iBJ2ysV9.js";
-import "../middleware-BfG_fp8P.js";
+import "../middleware-Do9XNe0Y.js";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import z from "@deepseek-ai/schemastery";
@@ -1355,9 +1355,9 @@ function operatorRoutes(prefix, secret, door, reportError) {
 		}
 	});
 }
-/** The upgrade request comes from this app's own page: a loopback peer on this port, and an `Origin` that is exactly this app's origin. Nothing else is read as proof. */
+/** The upgrade request comes from this app's own page: a loopback peer on this port (or the hosted app's trusted front), and an `Origin` that is exactly this app's origin. Nothing else is read as proof. */
 const ownOrigin = async (c, next) => {
-	const authority = loopbackAuthority(c);
+	const authority = pageAuthority(c);
 	const origin = c.req.header("origin");
 	const site = c.req.header("sec-fetch-site");
 	if (authority === void 0 || origin === void 0 || origin !== authority.origin || site !== void 0 && site !== "same-origin") return c.json(error("only this app's own page may open the channel"), 403);

package/lib/cordis/inspect.js

@@ -1,7 +1,7 @@
 import { t as Acryl } from "../app-CQcGWjrk.js";
-import { i as loopbackOnly } from "../loopback-only-BbasoF7R.js";
+import { a as loopbackOnly } from "../loopback-only-BoBCuDv7.js";
 import "../src-iBJ2ysV9.js";
-import "../middleware-BfG_fp8P.js";
+import "../middleware-Do9XNe0Y.js";
 import { Service } from "@deepseek-ai/cordis";
 //#region ../../plugins/acryl-inspect/src/report.ts
 /**

package/lib/cordis/state.js

@@ -1,10 +1,10 @@
 import { t as Acryl } from "../app-CQcGWjrk.js";
 import { t as methodNotAllowed } from "../method-not-allowed-TO2_hnfl.js";
 import { r as streamSSE } from "../streaming-BlDaph8U.js";
-import { i as loopbackOnly, r as loopbackAuthority } from "../loopback-only-BbasoF7R.js";
+import { a as loopbackOnly, o as pageAuthority } from "../loopback-only-BoBCuDv7.js";
 import "../helpers-BEjcdbgw.js";
 import "../src-iBJ2ysV9.js";
-import "../middleware-BfG_fp8P.js";
+import "../middleware-Do9XNe0Y.js";
 import { Service } from "@deepseek-ai/cordis";
 //#region ../../plugins/acryl-state/src/cell.ts
 /** A writable cell. `report` receives anything a listener throws; one failing listener never blocks the others. */
@@ -305,7 +305,7 @@ export function watch(key, onValue, onError) {
 `;
 /** A refusal (403) unless the upgrade comes from this machine to this app, and from its own page when it comes from a page at all. */
 function refuseStranger(c) {
-	const authority = loopbackAuthority(c);
+	const authority = pageAuthority(c);
 	if (authority === void 0) return c.json({ error: "request authority rejected" }, 403);
 	const origin = c.req.header("origin");
 	const site = c.req.header("sec-fetch-site");

package/lib/door/host.js

@@ -1,2 +1,2 @@
-import { d as AuditLog, f as auditPath, n as HEARTBEAT_MS, p as UiChannel, r as pageChannelRoutes, t as renderSnapshot } from "../snapshot-text-CXTnjxGx.js";
+import { d as AuditLog, f as auditPath, n as HEARTBEAT_MS, p as UiChannel, r as pageChannelRoutes, t as renderSnapshot } from "../snapshot-text-B9PWQoX6.js";
 export { AuditLog, HEARTBEAT_MS, UiChannel, auditPath, pageChannelRoutes, renderSnapshot };

package/lib/{loopback-only-BbasoF7R.js → loopback-only-BoBCuDv7.js}

@@ -23,7 +23,7 @@ function loopbackAuthority(c, hostnames = LOOPBACK_HOSTNAMES) {
 	const { remoteAddress, localPort } = connectionOf(c);
 	const host = c.req.header("host");
 	if (remoteAddress === void 0 || localPort === void 0 || host === void 0) return void 0;
-	const address = (remoteAddress.replace(/^\[|\]$/gu, "").split("%", 1)[0] ?? "").replace(/^::ffff:/iu, "");
+	const address = peerAddress(remoteAddress);
 	const family = isIP(address);
 	if (family === 0 || !loopback.check(address, family === 4 ? "ipv4" : "ipv6")) return void 0;
 	let authority;
@@ -35,13 +35,54 @@ function loopbackAuthority(c, hostnames = LOOPBACK_HOSTNAMES) {
 	if (authority.protocol !== "http:" || Number(authority.port || "80") !== localPort || !hostnames.includes(authority.hostname) || c.req.header("sec-fetch-site") === "cross-site") return void 0;
 	return authority;
 }
+/** The front the environment configures, or `undefined` when it configures none or an invalid one (an invalid one is refused, never half used). */
+function trustedFrontFromEnv(env = process.env) {
+	const origin = env.ACRYL_PUBLIC_ORIGIN?.trim();
+	const proxies = (env.ACRYL_TRUSTED_PROXY ?? "").split(",").map((peer) => peerAddress(peer.trim())).filter((peer) => peer !== "");
+	if (origin === void 0 || origin === "" || proxies.length === 0) return void 0;
+	if (originOf(origin) !== origin || !/^https?:$/u.test(new URL(origin).protocol)) return void 0;
+	if (proxies.some((peer) => isIP(peer) === 0)) return void 0;
+	return Object.freeze({
+		origin,
+		proxies: Object.freeze(proxies)
+	});
+}
+let configuredFront = null;
+/** The front of this process, read from the environment once. */
+function trustedFront() {
+	if (configuredFront === null) configuredFront = trustedFrontFromEnv();
+	return configuredFront;
+}
+function peerAddress(address) {
+	return (address.replace(/^\[|\]$/gu, "").split("%", 1)[0] ?? "").replace(/^::ffff:/iu, "");
+}
+/**
+* The public authority of a request the trusted front passed on: the peer is exactly one of the front's addresses, the `Host` is exactly the
+* public host, and the browser did not mark it cross-site. Anything else, or no front, gives `undefined`. The peer comes from the transport, never a
+* header, so a page on another box cannot claim to be the front.
+*/
+function frontAuthority(c, front = trustedFront()) {
+	if (front === void 0) return void 0;
+	const { remoteAddress } = connectionOf(c);
+	if (remoteAddress === void 0 || !front.proxies.includes(peerAddress(remoteAddress))) return void 0;
+	const publicOrigin = new URL(front.origin);
+	if (c.req.header("host") !== publicOrigin.host || c.req.header("sec-fetch-site") === "cross-site") return void 0;
+	return publicOrigin;
+}
+/**
+* The authority a browser page of this app reached it under: the loopback one, or the trusted front's public one. For routes a page calls; an
+* operator route (the door's `.acryl/bin/acryl` calls) keeps {@link loopbackAuthority}, so nothing outside the box can operate the app.
+*/
+function pageAuthority(c, hostnames = LOOPBACK_HOSTNAMES, front = trustedFront()) {
+	return loopbackAuthority(c, hostnames) ?? frontAuthority(c, front);
+}
 /** Whether a changing request is acceptable by its `Origin`: absent (not a browser cross-origin change) or naming this same authority. `null` and any other origin are not. */
 function sameOrigin(c, authority) {
 	const origin = c.req.header("origin");
 	if (origin === void 0) return true;
 	try {
 		const parsed = new URL(origin);
-		return parsed.protocol === "http:" && parsed.host === authority.host && parsed.pathname === "/";
+		return parsed.origin === authority.origin && parsed.pathname === "/" && parsed.search === "";
 	} catch {
 		return false;
 	}
@@ -75,7 +116,7 @@ function loopbackOnly(options = {}) {
 			await next();
 			return;
 		}
-		const authority = loopbackAuthority(c, options.hostnames);
+		const authority = pageAuthority(c, options.hostnames, "front" in options ? options.front : trustedFront());
 		if (authority === void 0) return c.json({ error: "request authority rejected" }, 403);
 		if (ownPage) {
 			if (!fromOwnPage(c, authority)) return c.json({ error: "only this app's own page may call this" }, 403);
@@ -87,4 +128,4 @@ function loopbackOnly(options = {}) {
 	};
 }
 //#endregion
-export { sameOrigin as a, loopbackOnly as i, fromOwnPage as n, loopbackAuthority as r, LOOPBACK_HOSTNAMES as t };
+export { loopbackOnly as a, trustedFront as c, loopbackAuthority as i, trustedFrontFromEnv as l, fromOwnPage as n, pageAuthority as o, frontAuthority as r, sameOrigin as s, LOOPBACK_HOSTNAMES as t };

package/lib/loopback-only.d.ts

@@ -24,6 +24,8 @@ interface LoopbackOptions {
    * same-origin` and a `Referer` from this authority. `mutations` is not consulted: every request is held to that rule.
    */
   readonly callers?: 'local' | 'own-page';
+  /** The hosted app's trusted front; default: the one the environment configures ({@link trustedFront}), usually none. Tests pass one. */
+  readonly front?: TrustedFront | undefined;
 }
 /**
  * The authority a loopback request addressed: the `Host` header as a URL, or `undefined` when the request does not come from a loopback peer to the
@@ -32,6 +34,32 @@ interface LoopbackOptions {
  */
 declare const LOOPBACK_HOSTNAMES: readonly string[];
 declare function loopbackAuthority(c: Context, hostnames?: readonly string[]): URL | undefined;
+/**
+ * A hosted app's one trusted front (spec 049 M9, design `m9-hosted-workspace.md` C): the reverse proxy that serves this app's page under a public
+ * origin, for example `https://a1b2.213-47-80-26.sslip.io`. Only the hosting template sets it, through `ACRYL_PUBLIC_ORIGIN` and
+ * `ACRYL_TRUSTED_PROXY` (the proxy's exact peer addresses, comma separated). Unset, nothing changes: an app accepts its own page on loopback only.
+ */
+interface TrustedFront {
+  /** The public origin the front serves this app's page from: a scheme and a host, no path. */
+  readonly origin: string;
+  /** The exact peer addresses the front connects from; no ranges, so another box on the same network is never the front. */
+  readonly proxies: readonly string[];
+}
+/** The front the environment configures, or `undefined` when it configures none or an invalid one (an invalid one is refused, never half used). */
+declare function trustedFrontFromEnv(env?: NodeJS.ProcessEnv): TrustedFront | undefined;
+/** The front of this process, read from the environment once. */
+declare function trustedFront(): TrustedFront | undefined;
+/**
+ * The public authority of a request the trusted front passed on: the peer is exactly one of the front's addresses, the `Host` is exactly the
+ * public host, and the browser did not mark it cross-site. Anything else, or no front, gives `undefined`. The peer comes from the transport, never a
+ * header, so a page on another box cannot claim to be the front.
+ */
+declare function frontAuthority(c: Context, front?: TrustedFront | undefined): URL | undefined;
+/**
+ * The authority a browser page of this app reached it under: the loopback one, or the trusted front's public one. For routes a page calls; an
+ * operator route (the door's `.acryl/bin/acryl` calls) keeps {@link loopbackAuthority}, so nothing outside the box can operate the app.
+ */
+declare function pageAuthority(c: Context, hostnames?: readonly string[], front?: TrustedFront | undefined): URL | undefined;
 /** Whether a changing request is acceptable by its `Origin`: absent (not a browser cross-origin change) or naming this same authority. `null` and any other origin are not. */
 declare function sameOrigin(c: Context, authority: URL): boolean;
 /** Whether the request comes from a page served by this authority itself: the `own-page` rule of {@link LoopbackOptions.callers}. */
@@ -42,4 +70,4 @@ declare function fromOwnPage(c: Context, authority: URL): boolean;
  */
 declare function loopbackOnly(options?: LoopbackOptions): MiddlewareHandler;
 //#endregion
-export { LOOPBACK_HOSTNAMES, LoopbackOptions, fromOwnPage, loopbackAuthority, loopbackOnly, sameOrigin };
+export { LOOPBACK_HOSTNAMES, LoopbackOptions, TrustedFront, fromOwnPage, frontAuthority, loopbackAuthority, loopbackOnly, pageAuthority, sameOrigin, trustedFront, trustedFrontFromEnv };

package/lib/loopback-only.js

@@ -1,2 +1,2 @@
-import { a as sameOrigin, i as loopbackOnly, n as fromOwnPage, r as loopbackAuthority, t as LOOPBACK_HOSTNAMES } from "./loopback-only-BbasoF7R.js";
-export { LOOPBACK_HOSTNAMES, fromOwnPage, loopbackAuthority, loopbackOnly, sameOrigin };
+import { a as loopbackOnly, c as trustedFront, i as loopbackAuthority, l as trustedFrontFromEnv, n as fromOwnPage, o as pageAuthority, r as frontAuthority, s as sameOrigin, t as LOOPBACK_HOSTNAMES } from "./loopback-only-BoBCuDv7.js";
+export { LOOPBACK_HOSTNAMES, fromOwnPage, frontAuthority, loopbackAuthority, loopbackOnly, pageAuthority, sameOrigin, trustedFront, trustedFrontFromEnv };

package/lib/{middleware-BfG_fp8P.js → middleware-Do9XNe0Y.js}

@@ -8,5 +8,5 @@ import "./jwt-lyS4Q3mT.js";
 import "./method-not-allowed-TO2_hnfl.js";
 import "./serve-static-EiJf1zkO.js";
 import "./timeout-FeqZ9A-0.js";
-import "./loopback-only-BbasoF7R.js";
+import "./loopback-only-BoBCuDv7.js";
 export {};

package/lib/{snapshot-text-CXTnjxGx.js → snapshot-text-B9PWQoX6.js}

@@ -2,11 +2,11 @@ import { t as Acryl } from "./app-CQcGWjrk.js";
 import { t as bodyLimit } from "./body-limit-WmIjWRLt.js";
 import { t as methodNotAllowed } from "./method-not-allowed-TO2_hnfl.js";
 import { r as streamSSE } from "./streaming-BlDaph8U.js";
-import { i as loopbackOnly, r as loopbackAuthority } from "./loopback-only-BbasoF7R.js";
+import { a as loopbackOnly, i as loopbackAuthority } from "./loopback-only-BoBCuDv7.js";
 import "./helpers-BEjcdbgw.js";
 import { d as parseChannelToHost, l as UiControlError, u as WINDOW_ID } from "./protocol-CQ_if7Dg.js";
 import "./src-iBJ2ysV9.js";
-import "./middleware-BfG_fp8P.js";
+import "./middleware-Do9XNe0Y.js";
 import { dirname, join } from "node:path";
 import { closeSync, mkdirSync, openSync, readFileSync, renameSync, statSync, writeSync } from "node:fs";
 import { timingSafeEqual } from "node:crypto";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "acrylblends",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "The Acryl web framework (import { Acryl } from \"acrylblends\") and the acrylblends command that scaffolds Cordis apps.",
   "license": "MIT",
   "type": "module",

package/plugins/acryl-door/src/host/page-socket.ts

@@ -10,7 +10,7 @@
 
 import { Acryl, type MiddlewareHandler } from 'acryl-router'
 import type { UpgradeWebSocket, WSEvents } from 'acryl-router/helpers'
-import { loopbackAuthority } from 'acryl-router/middleware'
+import { pageAuthority } from 'acryl-router/middleware'
 import { parseChannelToHost, WINDOW_ID } from '../page/protocol.ts'
 import type { UiChannel } from './channel.ts'
 import { error } from './http.ts'
@@ -25,9 +25,9 @@ export interface PageSocketOptions {
   readonly heartbeatMs?: number
 }
 
-/** The upgrade request comes from this app's own page: a loopback peer on this port, and an `Origin` that is exactly this app's origin. Nothing else is read as proof. */
+/** The upgrade request comes from this app's own page: a loopback peer on this port (or the hosted app's trusted front), and an `Origin` that is exactly this app's origin. Nothing else is read as proof. */
 export const ownOrigin: MiddlewareHandler = async (c, next) => {
-  const authority = loopbackAuthority(c)
+  const authority = pageAuthority(c)
   const origin = c.req.header('origin')
   const site = c.req.header('sec-fetch-site')
   if (authority === undefined || origin === undefined || origin !== authority.origin || (site !== undefined && site !== 'same-origin')) {

package/plugins/acryl-router/src/middleware/index.ts

@@ -25,4 +25,4 @@ export { NONCE, secureHeaders, type SecureHeadersVariables } from '../core/middl
 export { timeout } from '../core/middleware/timeout/index.ts'
 export { endTime, setMetric, startTime, timing, wrapTime, type TimingVariables } from '../core/middleware/timing/index.ts'
 export { appendTrailingSlash, trimTrailingSlash } from '../core/middleware/trailing-slash/index.ts'
-export { LOOPBACK_HOSTNAMES, fromOwnPage, loopbackAuthority, loopbackOnly, sameOrigin, type LoopbackOptions } from './loopback-only.ts'
+export { LOOPBACK_HOSTNAMES, frontAuthority, fromOwnPage, loopbackAuthority, loopbackOnly, pageAuthority, sameOrigin, trustedFront, trustedFrontFromEnv, type LoopbackOptions, type TrustedFront } from './loopback-only.ts'

package/plugins/acryl-router/src/middleware/loopback-only.ts

@@ -26,6 +26,8 @@ export interface LoopbackOptions {
    * same-origin` and a `Referer` from this authority. `mutations` is not consulted: every request is held to that rule.
    */
   readonly callers?: 'local' | 'own-page'
+  /** The hosted app's trusted front; default: the one the environment configures ({@link trustedFront}), usually none. Tests pass one. */
+  readonly front?: TrustedFront | undefined
 }
 
 const loopback = new BlockList()
@@ -45,7 +47,7 @@ export function loopbackAuthority(c: Context, hostnames: readonly string[] = LOO
   const { remoteAddress, localPort } = connectionOf(c)
   const host = c.req.header('host')
   if (remoteAddress === undefined || localPort === undefined || host === undefined) return undefined
-  const address = (remoteAddress.replace(/^\[|\]$/gu, '').split('%', 1)[0] ?? '').replace(/^::ffff:/iu, '')
+  const address = peerAddress(remoteAddress)
   const family = isIP(address)
   if (family === 0 || !loopback.check(address, family === 4 ? 'ipv4' : 'ipv6')) return undefined
   let authority: URL
@@ -63,13 +65,73 @@ export function loopbackAuthority(c: Context, hostnames: readonly string[] = LOO
   return authority
 }
 
+/**
+ * A hosted app's one trusted front (spec 049 M9, design `m9-hosted-workspace.md` C): the reverse proxy that serves this app's page under a public
+ * origin, for example `https://a1b2.213-47-80-26.sslip.io`. Only the hosting template sets it, through `ACRYL_PUBLIC_ORIGIN` and
+ * `ACRYL_TRUSTED_PROXY` (the proxy's exact peer addresses, comma separated). Unset, nothing changes: an app accepts its own page on loopback only.
+ */
+export interface TrustedFront {
+  /** The public origin the front serves this app's page from: a scheme and a host, no path. */
+  readonly origin: string
+  /** The exact peer addresses the front connects from; no ranges, so another box on the same network is never the front. */
+  readonly proxies: readonly string[]
+}
+
+/** The front the environment configures, or `undefined` when it configures none or an invalid one (an invalid one is refused, never half used). */
+export function trustedFrontFromEnv(env: NodeJS.ProcessEnv = process.env): TrustedFront | undefined {
+  const origin = env.ACRYL_PUBLIC_ORIGIN?.trim()
+  const proxies = (env.ACRYL_TRUSTED_PROXY ?? '').split(',').map(peer => peerAddress(peer.trim())).filter(peer => peer !== '')
+  if (origin === undefined || origin === '' || proxies.length === 0) return undefined
+  if (originOf(origin) !== origin || !/^https?:$/u.test(new URL(origin).protocol)) return undefined
+  if (proxies.some(peer => isIP(peer) === 0)) return undefined
+  return Object.freeze({ origin, proxies: Object.freeze(proxies) })
+}
+
+let configuredFront: TrustedFront | undefined | null = null
+
+/** The front of this process, read from the environment once. */
+export function trustedFront(): TrustedFront | undefined {
+  if (configuredFront === null) configuredFront = trustedFrontFromEnv()
+  return configuredFront
+}
+
+function peerAddress(address: string): string {
+  return (address.replace(/^\[|\]$/gu, '').split('%', 1)[0] ?? '').replace(/^::ffff:/iu, '')
+}
+
+/**
+ * The public authority of a request the trusted front passed on: the peer is exactly one of the front's addresses, the `Host` is exactly the
+ * public host, and the browser did not mark it cross-site. Anything else, or no front, gives `undefined`. The peer comes from the transport, never a
+ * header, so a page on another box cannot claim to be the front.
+ */
+export function frontAuthority(c: Context, front: TrustedFront | undefined = trustedFront()): URL | undefined {
+  if (front === undefined) return undefined
+  const { remoteAddress } = connectionOf(c)
+  if (remoteAddress === undefined || !front.proxies.includes(peerAddress(remoteAddress))) return undefined
+  const publicOrigin = new URL(front.origin)
+  if (c.req.header('host') !== publicOrigin.host || c.req.header('sec-fetch-site') === 'cross-site') return undefined
+  return publicOrigin
+}
+
+/**
+ * The authority a browser page of this app reached it under: the loopback one, or the trusted front's public one. For routes a page calls; an
+ * operator route (the door's `.acryl/bin/acryl` calls) keeps {@link loopbackAuthority}, so nothing outside the box can operate the app.
+ */
+export function pageAuthority(
+  c: Context,
+  hostnames: readonly string[] = LOOPBACK_HOSTNAMES,
+  front: TrustedFront | undefined = trustedFront(),
+): URL | undefined {
+  return loopbackAuthority(c, hostnames) ?? frontAuthority(c, front)
+}
+
 /** Whether a changing request is acceptable by its `Origin`: absent (not a browser cross-origin change) or naming this same authority. `null` and any other origin are not. */
 export function sameOrigin(c: Context, authority: URL): boolean {
   const origin = c.req.header('origin')
   if (origin === undefined) return true
   try {
     const parsed = new URL(origin)
-    return parsed.protocol === 'http:' && parsed.host === authority.host && parsed.pathname === '/'
+    return parsed.origin === authority.origin && parsed.pathname === '/' && parsed.search === ''
   } catch {
     return false
   }
@@ -106,7 +168,7 @@ export function loopbackOnly(options: LoopbackOptions = {}): MiddlewareHandler {
       await next()
       return
     }
-    const authority = loopbackAuthority(c, options.hostnames)
+    const authority = pageAuthority(c, options.hostnames, 'front' in options ? options.front : trustedFront())
     if (authority === undefined) return c.json({ error: 'request authority rejected' }, 403)
     if (ownPage) {
       if (!fromOwnPage(c, authority)) return c.json({ error: 'only this app\'s own page may call this' }, 403)

package/plugins/acryl-state/src/socket.ts

@@ -13,7 +13,7 @@
 
 import type { Context, MiddlewareHandler } from 'acryl-router'
 import type { UpgradeWebSocket } from 'acryl-router/helpers'
-import { loopbackAuthority } from 'acryl-router/middleware'
+import { pageAuthority } from 'acryl-router/middleware'
 import type { ReadonlyCell } from './cell.ts'
 
 /** How often the server writes a `ping`; a page gives up on a socket that is silent for three of these. */
@@ -34,7 +34,7 @@ export interface StateSocketOptions {
 
 /** A refusal (403) unless the upgrade comes from this machine to this app, and from its own page when it comes from a page at all. */
 export function refuseStranger(c: Context): Response | undefined {
-  const authority = loopbackAuthority(c)
+  const authority = pageAuthority(c)
   if (authority === undefined) return c.json({ error: 'request authority rejected' }, 403)
   const origin = c.req.header('origin')
   const site = c.req.header('sec-fetch-site')

package/plugins/agent-panel/index.ts

@@ -22,7 +22,7 @@ import type { Context } from '@deepseek-ai/cordis'
 import { clientModules } from '../acryl-node-server/src/client-modules.ts'
 import { streamSSE, type UpgradeWebSocket } from '../acryl-router/src/helpers/index.ts'
 import { Acryl, type MiddlewareHandler } from '../acryl-router/src/index.ts'
-import { loopbackAuthority } from '../acryl-router/src/middleware/index.ts'
+import { pageAuthority } from '../acryl-router/src/middleware/index.ts'
 import type {} from '../agent/index.ts'
 import type {} from '../extensions/index.ts'
 import type { ChatDriver, Driver } from './drivers.ts'
@@ -419,7 +419,7 @@ export function apply(ctx: Context, config: PanelConfig = {}): void {
     }
     const ws = new Acryl()
     const own: MiddlewareHandler = async (c, next) => {
-      const authority = loopbackAuthority(c)
+      const authority = pageAuthority(c)
       const origin = c.req.header('origin')
       const site = c.req.header('sec-fetch-site')
       if (