geneseed 4.17.0 → 4.17.2

package/CHANGELOG.md

@@ -8,6 +8,26 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.17.2] — 2026-10-24
+
+Patch: the web console closes its security and data-loss holes from the 2026-10-24 audit.
+
+### Security
+- **Restore acts only on what the diff offers.** `POST /api/actions/restore` trusted the client's file list: one call could reset `user-rules.md`, `PROFILE.md` or a memory file to its seed, or delete a file the diff never listed. It now restores only the paths `/api/diff` offers, computed on the server. It never touches the files written once and then left to you (`user-rules.md`, `PROFILE.md`, `memory/`, `notebook/`). An added file is moved to `archived-restore/<stamp>/` in the install instead of being deleted.
+- **The web console cannot be framed or driven from another site.** Every response carries a Content-Security-Policy with `frame-ancestors 'none'` and a per-response nonce on the token script, plus `X-Frame-Options: DENY`, `nosniff` and `Referrer-Policy: no-referrer`. One request guard checks the exact Host and port, refuses a cross-site `/api` request (`Sec-Fetch-Site`, foreign `Origin`), and compares the token in constant time. A repeated `GET /api/doctor?fresh=1` reuses a run less than 3 s old. The server sets request and header timeouts.
+- **The markdown sanitizer drops SVG animation elements, `template`, raw-text elements and `style` attributes.** These closed a `javascript:` link set through `<set>`/`<animate>`, a full-page overlay drawn with `style`, and a mutation XSS through `xmp`, `noembed`, `noframes`, `noscript` or `plaintext`.
+
+### Fixed
+- **Settings › Maintenance no longer offers an Uninstall.** It ran `geneseed uninstall --yes` with no target, so it always removed the OpenCode global install, whichever install you were viewing. Each install keeps its own Uninstall in Installs › Hosts.
+- **Editing a rule keeps its scope.** A rule written `scope: global` was saved back as `project` on every Edit or Graduate. A scope the editor does not list is now kept as written. A rule body with a line that reads as a rule heading (`## …`) is refused with a 400, because it could create a second rule with a forged id. So is a `|` in the scope or source.
+
+## [4.17.1] — 2026-10-23
+
+Patch: the web console's Update button works on a global npm install and re-checks for updates while the page is open.
+
+### Changed
+- **The web console's Update button follows the install.** On a clone it runs `upgrade`, as before. On a global npm install it now runs `npm install -g geneseed@latest` and then the new package's `rebuild-all`, where it used to fail with "not a git checkout". On any other copy (an npx cache, a project's `node_modules`, an unzipped folder) it shows the command to run instead of a button. A clone also says whether there is anything to pull ("3 commits to pull", "up to date") from a daily background `git fetch`. An Overview page left open asks again every hour and when its tab comes back into view, so it shows a new release within a day.
+
 ## [4.17.0] — 2026-10-23
 
 Minor: doctrine comms 5 Mark the Ask; a version bump on main now releases itself; two Bob fixes.

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.17.0**.
+> string. Current label: **4.17.2**.
 
 ## Capabilities
 

package/docs/extending.md

@@ -125,7 +125,7 @@ Notes that matter:
 
 ### The gates CI does not run
 
-- **The mutation matrix itself.** `tests/mutate.mjs` — 35 rows, each a one-string edit to a
+- **The mutation matrix itself.** `tests/mutate.mjs` — 34 rows, each a one-string edit to a
   product file with a written argument for which gate should catch it. The full run is **in no
   workflow** and should not be: it mutates the product tree 33 times and runs a gate per edit.
   Run `node tests/mutate.mjs --all` (or `--only M7`) by hand when you change something a gate is

package/docs/guides/upgrade.md

@@ -34,7 +34,23 @@ geneseed upgrade imperial     # the same, switching the theme
 
 A dirty working tree, or a folder that is not a git clone, is reported rather than force-updated. `update` and `sync-self` are aliases of `upgrade`. `bootstrap` does the same and then opens the setup wizard (`--no-setup` skips the wizard).
 
-In the web console, the **Update** button on the Overview runs `upgrade`. On a clone it is always there, also when the release check cannot reach npm, because `main` moves between releases. When the update is done, the console restarts and the page reloads. If you ran `git pull` yourself, the Overview shows a banner that the console runs old code. Click **Rebuild** on an install that is behind: the console restarts after the rebuild and reloads the page. If no install is behind, click **Restart** in the banner.
+## The Update button in the web console
+
+The **Update** button on the Overview picks its route from how this copy of Geneseed is installed:
+
+| Install | What **Update** runs | When the button shows |
+|---|---|---|
+| A clone (or a worktree) | `geneseed upgrade` | Always, because `main` moves between releases. |
+| A global npm install (`npm root -g`/geneseed) | `npm install -g geneseed@latest`, then `geneseed rebuild-all` from the new package | When npm has a newer release. |
+| Anything else (an npx cache, a project's `node_modules`, an unzipped copy) | Nothing. The Overview shows the command to run instead. | Never. |
+
+On a clone, the Overview also says whether there is anything to pull. Once a day the console runs `git fetch` in the background and counts the commits upstream has that the clone does not: "3 commits to pull", or "up to date". The fetch has the same timeout as `upgrade` (`GENESEED_NET_TIMEOUT`, 120 s by default). If the fetch fails, the Overview shows the release check instead, and the button stays. `GENESEED_NO_UPDATE_CHECK` turns off both the npm check and the fetch.
+
+The console asks npm for the latest release once a day. An Overview page that stays open asks the console again every hour, and each time you come back to its tab, so it shows a new release within a day.
+
+The npm route never uses `sudo` and never retries. If npm refuses (no permission on the global folder, a proxy, a private registry), the job log shows npm's own output. Fix the cause, or run the two commands yourself.
+
+When the update is done, the console restarts and the page reloads. If you ran `git pull` yourself, the Overview shows a banner that the console runs old code. Click **Rebuild** on an install that is behind: the console restarts after the rebuild and reloads the page. If no install is behind, click **Restart** in the banner.
 
 ## What an upgrade keeps
 

package/docs/web-ui.md

@@ -44,6 +44,15 @@ so other sites can't trigger builds, deletes, or shutdown. Mutating actions (bui
 update, export, restore, memory-delete, uninstall) run in the background and report back
 as toasts (fire-and-notify). Read-only browsing needs no token.
 
+Every request passes one guard first: the `Host` must be `127.0.0.1`, `localhost` or `[::1]`
+**at the server's own port** (DNS rebinding, other local servers), `/api/*` refuses a
+`Sec-Fetch-Site` of `cross-site`/`same-site` or a foreign `Origin` (so another site cannot read
+the API either), and every write compares the token in constant time. Every response carries
+`X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, `Referrer-Policy: no-referrer` and a
+strict CSP (`frame-ancestors 'none'`, same-origin only, the one inline token script admitted by
+a per-response nonce). `?fresh=1` on the doctor re-runs at most once per 3 s, and the server
+drops a request whose headers take over 10 s or whose whole request takes over 30 s.
+
 ## The rail
 
 The left rail mirrors the harness's own shape:
@@ -89,7 +98,9 @@ streams the output of background jobs and keeps their history across reloads.
 
 - **Rules** (`#/rules`) — your own standing rules, read from and written to the
   `user-rules.md` beside the deployed AGENT.md (the seed-once file no update ever
-  touches). List with scope (user/project) and trial chips, add/edit/retire forms, a
+  touches). List with scope (user/project, or any other scope written by hand, which a
+  save keeps as written) and trial chips, add/edit/retire forms (a body line starting
+  `## ` is refused: the file would read it as a new rule heading), a
   **Graduate** action that adopts a trial rule for good, and a budget meter that turns
   amber as the always-loaded set gets heavy. Every write carries the fingerprint of the
   content the page last read — if an agent session edited the file meanwhile, the save
@@ -169,6 +180,9 @@ streams the output of background jobs and keeps their history across reloads.
 - **Changes** (`#/diff`) — the diff between the deployed harness and the source: edited /
   added / missing files with per-file expansion and coloured unified-diff lines. Select
   files to **export an `improvements.md`** back-port, or **restore** them to source.
+  Restore acts only on files the diff lists, and never on your own files (`user-rules.md`,
+  `PROFILE.md`, `memory/`, `notebook/`). An added file is moved into
+  `archived-restore/<date-time>/` in the install, not deleted.
 - **Doctor** (`#/doctor`) — runs the same health engine as the `doctor` command (every
   theme, parity, links, authoring gates, drift), grouping any problems per check. It shows
   the server's last run — warmed at start, redone after a job, an install toggle or a view
@@ -207,8 +221,8 @@ streams the output of background jobs and keeps their history across reloads.
   console: Cultivar, Operator, Matrix or Atlas) with a **Dashboard layout** control (Auto follows each theme's designed Status
   lens; Cultivar / Greenhouse / Operator / Journal force one regardless of skin), the
   install snapshot (deployed/target/theme/version/memory store), a Maintenance card (PATH
-  link/unlink, uninstall), an offline package download, server controls (Stop), and the
-  **About** colophon — project + creator credits and the source link, folded in from the
+  link/unlink and Update; each install is uninstalled from its own panel in Hosts), an
+  offline package download, server controls (Stop), and the **About** colophon — project + creator credits and the source link, folded in from the
   retired `#/about` tab (which still resolves here). Build, update, and MCP wiring live in
   the Harness tab.
 

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.17.0"
+  "version": "4.17.2"
 }

package/js/README.md

@@ -235,7 +235,7 @@ the deployed harness as JSON.
 |---|---|
 | `server.mjs` | `serve()`/`cmdWeb`: UI-build precheck, socket bind, token mint, daemon record wiring |
 | `routes.mjs` | The route tables — `STATE_ROUTES`, `PREFIX_ROUTES`, `POST_ROUTES` (+ its 409 column) — and the inline lists |
-| `handler.mjs` | One function per request: dispatch, gzip, Host/CSRF guards and body cap (before the body is read), static SPA fallback |
+| `handler.mjs` | One function per request: dispatch, gzip, `requestGuard` (Host+port, Origin/Sec-Fetch-Site on `/api`, constant-time CSRF token) and body cap (before the body is read), `securityHeaders` (CSP nonce, framing), static SPA fallback |
 | `state.mjs` | `webState` — the resolved install view every endpoint reads, with its cached inventory and doctor |
 | `catalog.mjs` | The Library read model: inventory, constitution tiers, memory/notebook/wiki/config items, `apiCatalog`/`apiItem`, `NotFound` |
 | `api.mjs` | The dashboard and settings reads: overview, recent, themes, setup, doctor, diff, installs, excludes, loops |

package/js/web/actions.mjs

@@ -27,7 +27,8 @@
  */
 import { spawn } from 'node:child_process';
 import {
-  accessSync, constants, copyFileSync, mkdirSync, mkdtempSync, realpathSync, rmSync, unlinkSync,
+  accessSync, constants, copyFileSync, existsSync, mkdirSync, mkdtempSync, realpathSync,
+  renameSync, rmSync,
 } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -36,7 +37,8 @@ import { emitGlobalInto } from '../build/driver.mjs';
 import {
   ROOT, discoverNames, knownRuleIds, loadKits, PACK_ORDER,
 } from '../build/source.mjs';
-import { withStdoutSwallowed } from '../inspect/diff.mjs';
+import { diffCollect, drifted, withStdoutSwallowed } from '../inspect/diff.mjs';
+import { SESSION_FILES } from '../hosts/hooks-context.mjs';
 import { excludeAdd, excludeRemove } from '../inspect/excludes.mjs';
 import { installProfile, setupBuildArgs } from '../build/generate.mjs';
 import { DEFAULT_PRESET, PRESETS } from '../loop/score.mjs';
@@ -503,13 +505,30 @@ export function globalEmitHostFor(emit) {
   return HOSTS.some((h) => h.host === host) ? host : 'opencode';
 }
 
+/**
+ * The session files' names and their top folders (`memory/`, `notebook/`, …): seed-once, the
+ * user's after the first build. Derived from `SESSION_FILES`, the one list of them.
+ */
+const SEED_FILES = new Set(SESSION_FILES.filter((r) => !r.includes('/')));
+const SEED_DIRS = new Set(SESSION_FILES.filter((r) => r.includes('/')).map((r) => r.split('/')[0]));
+const isSeedOnce = (rel) => SEED_FILES.has(rel) || SEED_DIRS.has(rel.split('/')[0]);
+
 /**
  * Restore selected drifted files from the SOURCE render.
  *
  * Source wins and local edits are discarded (the inverse, keeping them, is Export
- * improvements). Renders the expected copy exactly as `diffCollect` does, then per rel:
- * expected present -> overwrite/create the deployed copy; expected absent but deployed present
- * (an 'added' file) -> delete it; neither -> an error and nothing touched.
+ * improvements). Renders the expected copy exactly as `diffCollect` does, then per rel, BY ITS
+ * DIFF STATUS: edited/missing -> overwrite/create the deployed copy; added -> move it into
+ * `archived-restore/<stamp>/` inside the install; anything else -> an error and nothing touched.
+ *
+ * THE CLIENT'S LIST IS A SELECTION, NEVER AN AUTHORITY. Only a rel the drift list offers is
+ * acted on, and that list is `diffCollect` with the arguments `apiDiff` passes, so the panel and
+ * this verb cannot disagree. Trusting the POST made it a write-or-delete primitive over the whole
+ * install (audit SE-1, 2026-10): one request reset `user-rules.md` and the memory index to their
+ * stubs, a second unlinked a memory fact and an unrelated secret file. The seed-once files are
+ * refused even when a manifest claims them. An added file is ARCHIVED, never unlinked, in the
+ * `archived-<name>/<stamp>` shape `archiveStore` gives uninstall; nothing owns the archive, so
+ * the next diff does not list it.
  *
  * SYNCHRONOUS, AND NOT A JOB. One render, the same cost as a diff GET, and it returns a
  * structured result rather than a job id — which is why the dispatcher answers it before it
@@ -534,7 +553,11 @@ export function apiRestore(state, files) {
   const restored = [];
   const deleted = [];
   const errors = [];
+  let archive = null;
   const target = resolvePath(state.target);
+  const offered = new Map(drifted(diffCollect({
+    target: state.target, theme: state.theme, emit: state.emit }).files ?? [])
+    .map((f) => [f.rel, f.status]));
   const tmp = mkdtempSync(path.join(os.tmpdir(), 'geneseed-restore-'));
   try {
     const expected = resolvePath(path.join(tmp, 'expected'));
@@ -566,26 +589,48 @@ export function apiRestore(state, files) {
       const rel = stripWhitespace(formatValue(raw).replace(/\\/g, '/')).replace(/^\/+/, '');
       const dst = resolvePath(path.join(target, rel));
       const src = resolvePath(path.join(expected, rel));
+      const status = offered.get(rel);
       if (!rel || !within(dst, target) || !within(src, expected)) {
         errors.push(`${rel}: outside the deployed tree`);
-      } else if (isFile(src)) {
-        mkdirSync(path.dirname(dst), { recursive: true });
-        // A BYTE copy, so the restored file keeps the render's own line endings rather than
-        // the platform's (the `writeText`/`copy2` rule, one file over).
-        copyFileSync(src, dst);
-        restored.push(rel);
-      } else if (isFile(dst)) {
-        unlinkSync(dst);
-        deleted.push(rel);
+      } else if (!status || isSeedOnce(rel)) {
+        errors.push(`${rel}: not a drifted file restore may touch`);
+      } else if (status !== 'added' && !isFile(src)) {
+        errors.push(`${rel}: not in the source render`);
+      } else if (status !== 'added') {
+        // Caught per file, so one EISDIR/EBUSY cannot lose the report of the files before it.
+        try {
+          mkdirSync(path.dirname(dst), { recursive: true });
+          // A BYTE copy, so the restored file keeps the render's own line endings rather than
+          // the platform's (the `writeText`/`copy2` rule, one file over).
+          copyFileSync(src, dst);
+          restored.push(rel);
+        } catch (e) {
+          errors.push(`${rel}: could not restore (${e.code || e.message})`);
+        }
       } else {
-        errors.push(`${rel}: not in the source render nor deployed`);
+        // `archiveStore`'s local `YYYYMMDD-HHMMSS` stamp, one per call; a taken name gets `-2`, …
+        archive ??= path.join(target, 'archived-restore', new Date().toLocaleString('sv-SE')
+          .replace(/\D/g, '').replace(/^(\d{8})/, '$1-'));
+        let dest = resolvePath(path.join(archive, rel));
+        for (let n = 2; existsSync(dest); n += 1) dest = resolvePath(path.join(archive, `${rel}-${n}`));
+        if (!within(dest, archive)) {
+          errors.push(`${rel}: outside the archive`);
+          continue;
+        }
+        try {
+          mkdirSync(path.dirname(dest), { recursive: true });
+          renameSync(dst, dest);
+          deleted.push(rel);
+        } catch (e) {
+          errors.push(`${rel}: could not archive (${e.code || e.message})`);
+        }
       }
     }
   } finally {
     rmSync(tmp, { recursive: true, force: true });
   }
   state.refresh();
-  return { restored, deleted, errors };
+  return { restored, deleted, errors, archive };
 }
 
 /** (host, scope) -> the emit name that installs it. */

package/js/web/api.mjs

@@ -8,7 +8,7 @@
  * bind paths to these functions are `routes.mjs`. This file imports none of its route siblings,
  * which is what keeps the old `api ↔ actions` and `api ↔ activity` cycles from coming back.
  */
-import { existsSync, readdirSync, statSync } from 'node:fs';
+import { readdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 
 import { CONFIG, CREDIT_RE, ROOT, SRC, THEMES, discoverNames, loadKits, makeCfg, upstreamOf } from '../build/source.mjs';
@@ -35,7 +35,7 @@ import {
   configItems, deployed, dget, memoryItems, notebookItems, wikiItems,
 } from './catalog.mjs';
 import { stampMinute, viewCfg } from './state.mjs';
-import { updateStatus } from './update-check.mjs';
+import { MANUAL_UPDATE, gitBehind, installKind, updateStatus } from './update-check.mjs';
 
 /**
  * `js/web/docs.mjs` imports these three from HERE, and that file is outside this split — so
@@ -80,13 +80,24 @@ export function apiSetup(state) {
   };
 }
 
+// Short: a user who fixes a problem and clicks Re-run must not be shown the old verdict for long.
+const DOCTOR_COOLDOWN_MS = 3_000;
+
 /**
  * The same engine as the `doctor` verb, grouped per check — served from the state's cached run
  * (a lens visit or a page mount no longer pays ~3.6 s), and re-run only when `fresh` is asked
  * for: the Doctor page's Re-run button, as `GET /api/doctor?fresh=1`.
+ *
+ * A fresh ask within `DOCTOR_COOLDOWN_MS` of the last one THIS PATH ran reuses that run, so a
+ * page looping on `?fresh=1` cannot pin the event loop. `_doctorFreshAt` is written here only: a
+ * verdict planted any other way still re-runs. No single-flight promise — `runDoctor` is
+ * synchronous, so two fresh runs cannot overlap (revisit if it ever goes async).
  */
 export function apiDoctor(state, fresh = false) {
-  if (fresh) state.runDoctor();
+  if (fresh && Date.now() - (state._doctorFreshAt ?? 0) >= DOCTOR_COOLDOWN_MS) {
+    state.runDoctor();
+    state._doctorFreshAt = Date.now();
+  }
   const { ok, problems, checked_at } = state.doctor;
   return { ...state._doctorRun, ok, problems, checked_at };
 }
@@ -499,12 +510,26 @@ export function apiLoopsActive() {
   return { loops: activeLoops() };
 }
 
-/** Is a newer release on npm than the source this console serves? See update-check.mjs. */
-// `git`: a clone updates by `git pull` whatever npm says — main moves between releases, and a
-// work proxy can leave the release check unanswered — so the console always offers Update there.
-// `.git` is a file in a worktree, a folder in a clone; existence covers both.
-export const apiUpdate = (state) => ({ ...updateStatus(state, releaseLabel()),
-  git: existsSync(path.join(ROOT, '.git')) });
+/**
+ * Is a newer release on npm than the source this console serves, and how would this copy take
+ * it? See update-check.mjs.
+ *
+ * `install` picks the Update route (`git`, `npm-global`, `other`); `git` is kept beside it for a
+ * console bundle older than the field. `behind` is a clone's own "up to date": commits upstream
+ * holds that it does not, null when unknown — a clone can always pull, since `main` moves between
+ * releases and a work proxy can leave the release check unanswered. `command` is what to run by
+ * hand when the console cannot update this copy itself.
+ */
+export function apiUpdate(state) {
+  const install = installKind();
+  return {
+    ...updateStatus(state, releaseLabel()),
+    install,
+    git: install === 'git',
+    behind: install === 'git' ? gitBehind(state, { busy: Boolean(state.jobBusy?.()) }) : null,
+    command: install === 'other' ? MANUAL_UPDATE : null,
+  };
+}
 
 /** The source's release label, or null when it cannot be read. */
 function releaseLabel() {

package/js/web/catalog.mjs

@@ -29,6 +29,9 @@ import { loadKits } from '../build/source.mjs';
 /** A requested catalog section or item that does not exist. */
 export class NotFound extends Error {}
 
+/** A request body the route refuses on its content (a 400, not a 500): the caller can fix it. */
+export class BadRequest extends Error {}
+
 /** `??` would also swallow an explicit `null` the file declared; this does not. */
 export const dget = (obj, key, dflt) => (Object.hasOwn(obj, key) ? obj[key] : dflt);
 

package/js/web/handler.mjs

@@ -6,29 +6,32 @@
  * surface testable at all. Keep the arity.
  *
  * What it actually uses of HTTP is small and deliberate — a whole-buffer `gzipSync` over a few
- * content types, two Cache-Control policies, a CSRF token on POST only, and a Host guard against
- * DNS rebinding. No streaming, no SSE, no ranges, no cookies, no CORS. The routes it honours are
+ * content types, two Cache-Control policies, one set of security headers (CSP with a per-response
+ * nonce) on every response, and one request guard (`requestGuard`) in front of every route. No
+ * streaming, no SSE, no ranges, no cookies, no CORS. The routes it honours are
  * declared next door in `routes.mjs`; the daemon that starts it is in `daemon.mjs`.
  */
 import { resolvePath } from '../hosts/hosts.mjs';
 import { isTruthy, jsonDumpsCompact } from '../lib/json.mjs';
 import { parseIntStrict, percentDecode } from '../lib/text.mjs';
-import { preflight } from '../maintain/update.mjs';
 import { apiDeployCmd, apiInstallCmd, apiPickFolder, apiRestore, buildActionCmds, mcpTargetPaths } from './actions.mjs';
-import { NotFound } from './catalog.mjs';
+import { BadRequest, NotFound } from './catalog.mjs';
 import { openUrl, requestRestart } from './daemon.mjs';
 import { apiDocs, apiDocsPage } from './docs.mjs';
-import { actionCommands } from './jobs.mjs';
+import { actionCommands, updatePlan } from './jobs.mjs';
 import { POST_ROUTES, PREFIX_ROUTES, STATE_ROUTES, readJsonBody } from './routes.mjs';
+import { installKind } from './update-check.mjs';
 import { isFile } from '../lib/fs.mjs';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { readFileSync, statSync } from 'node:fs';
 import { basename, dirname, extname, join, sep } from 'node:path';
 import { gzipSync } from 'node:zlib';
 
 /**
- * DNS-rebinding guard. `h.split(":", 1)[0]` keeps everything before the FIRST colon, so
- * `localhost:4747` passes and a bare IPv6 literal would not — which is what the `[::1]`
- * prefix check above it is for.
+ * DNS-rebinding guard, HOSTNAME ONLY. `h.split(":", 1)[0]` keeps everything before the FIRST
+ * colon, so `localhost:4747` passes and a bare IPv6 literal would not — which is what the `[::1]`
+ * prefix check above it is for. The server itself no longer calls it: `requestGuard` matches the
+ * exact `name:port` instead, which this looser predicate cannot express.
  */
 export function localHost(host) {
   const h = (host || '').trim().toLowerCase();
@@ -36,6 +39,62 @@ export function localHost(host) {
   return ['127.0.0.1', 'localhost'].includes(h.split(':', 1)[0]);
 }
 
+/**
+ * Sent on EVERY response, merged last so no caller's `extra` can weaken one. `frame-ancestors` +
+ * `X-Frame-Options` stop a foreign page from framing the console and clickjacking its buttons; the
+ * CSP admits the one inline script (the token) by `nonce`, so an injected `<script>` cannot run
+ * and read the token. `style-src 'unsafe-inline'` because the React UI sets `style=` attributes.
+ */
+export function securityHeaders(nonce) {
+  return {
+    'X-Frame-Options': 'DENY',
+    'Content-Security-Policy': "frame-ancestors 'none'; default-src 'self'; "
+      + `script-src 'self' 'nonce-${nonce}'; style-src 'self' 'unsafe-inline'; `
+      + "img-src 'self' data:; font-src 'self' data:; connect-src 'self'; worker-src 'self'; "
+      + "manifest-src 'self'; base-uri 'none'; form-action 'none'",
+    'X-Content-Type-Options': 'nosniff',
+    'Referrer-Policy': 'no-referrer',
+  };
+}
+
+/**
+ * THE one request guard, answered before dispatch (and before a POST body is read). `null` =
+ * pass, else `{ code, body }`.
+ *
+ * - Host must be an allowed hostname AT THIS SOCKET'S PORT, exactly: the hostname stops DNS
+ *   rebinding, the port stops another local server's page from posing as this origin.
+ * - `/api/*`: a cross-site or same-site fetch, or a foreign `Origin`, is refused even on GET —
+ *   the reads expose paths and memories. A request with neither header (curl, Node) passes.
+ * - Any non-GET: the CSRF token, compared in constant time so its bytes cannot be timed out.
+ */
+export function requestGuard(req, token) {
+  const host = req.headers.host || '';
+  // Exact `name:port`, not `localHost` + a suffix test: that pair let `[::1]x.evil:4747` and
+  // `localhost:1:4747` through. Lower-cased the way browsers send it.
+  const want = `:${req.socket.localPort}`;
+  const h = host.trim().toLowerCase();
+  if (!['127.0.0.1', 'localhost', '[::1]'].includes(h.endsWith(want) ? h.slice(0, -want.length) : '')) {
+    return { code: 403, body: { error: 'forbidden host' } };
+  }
+  const path = (req.url || '').split('?', 1)[0];
+  if (path.startsWith('/api/')) {
+    const site = req.headers['sec-fetch-site'];
+    const origin = req.headers.origin;
+    if (site === 'cross-site' || site === 'same-site'
+        || (origin !== undefined && origin !== `http://${host}`)) {
+      return { code: 403, body: { error: 'forbidden origin' } };
+    }
+  }
+  if (req.method !== 'GET') {
+    const got = Buffer.from(String(req.headers['x-geneseed-token'] ?? ''), 'utf-8');
+    const want = Buffer.from(token, 'utf-8');
+    if (got.length !== want.length || !timingSafeEqual(got, want)) {
+      return { code: 403, body: { error: 'forbidden' } };
+    }
+  }
+  return null;
+}
+
 const GZIP_TYPES = ['application/json', 'text/', 'image/svg+xml',
   'application/manifest+json', 'application/javascript'];
 const GZIP_MIN = 1024;
@@ -74,7 +133,8 @@ export function makeHandler(state, jm, token, dist, holder = null) {
   // page stayed blank with nothing logged on either side.
   const distReal = resolvePath(dist);
 
-  function sendBytes(res, body, ctype, code = 200, extra = null, acceptEncoding = '', gzStore = null) {
+  function sendBytes(res, body, ctype, code = 200, extra = null, acceptEncoding = '', gzStore = null,
+    nonce = randomBytes(16).toString('base64')) {
     const headers = { ...(extra || {}) };
     if (body.length >= GZIP_MIN && GZIP_TYPES.some((t) => ctype.startsWith(t))
         && (acceptEncoding || '').includes('gzip')) {
@@ -86,6 +146,7 @@ export function makeHandler(state, jm, token, dist, holder = null) {
       'Content-Type': ctype,
       'Content-Length': String(body.length),
       ...headers,
+      ...securityHeaders(nonce),
     });
     res.end(body);
   }
@@ -114,8 +175,10 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     }
     let data = entry.data;
     let extra = null;
+    // Fresh per response; for index.html the same value goes in the token script and its CSP.
+    const nonce = randomBytes(16).toString('base64');
     if (basename(fp) === 'index.html') {
-      const inject = Buffer.from(`<script>window.__GENESEED_TOKEN__="${token}";</script>`, 'utf-8');
+      const inject = Buffer.from(`<script nonce="${nonce}">window.__GENESEED_TOKEN__="${token}";</script>`, 'utf-8');
       data = replaceOnce(data, Buffer.from('</head>'), Buffer.concat([inject, Buffer.from('</head>')]));
       extra = { 'Cache-Control': 'no-store' };
       // The injected bytes differ from `entry.data`, so the gz cache must not serve them.
@@ -124,7 +187,7 @@ export function makeHandler(state, jm, token, dist, holder = null) {
       extra = { 'Cache-Control': 'public, max-age=31536000, immutable' };
     }
     return sendBytes(res, data, CTYPES[extname(fp)] || 'application/octet-stream',
-      200, extra, acceptEncoding, entry);
+      200, extra, acceptEncoding, entry, nonce);
   }
 
   function doGet(req, res, path, ae) {
@@ -156,19 +219,6 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     return serveStatic(res, path, ae);
   }
 
-  /** The Host and token guards, answered BEFORE a byte of the body is read. `true` = refused. */
-  function refusePost(req, res, ae) {
-    if (!localHost(req.headers.host)) {
-      sendJson(res, { error: 'forbidden host' }, 403, ae);
-      return true;
-    }
-    if (req.headers['x-geneseed-token'] !== token) {
-      sendJson(res, { error: 'forbidden' }, 403, ae);
-      return true;
-    }
-    return false;
-  }
-
   function doPost(req, res, path, ae, body) {
     if (path === '/api/shutdown') {
       if (jm.busy) return sendJson(res, BUSY, 409, ae);
@@ -287,16 +337,26 @@ export function makeHandler(state, jm, token, dist, holder = null) {
       return startJob(res, 'deploy', [plan.cmd], ae);
     }
     if (action === 'update') {
-      const pre = preflight();
-      if (!pre.ok) {
-        return sendJson(res,
-          { precondition: pre.code, kind: pre.kind, message: pre.message }, 422, ae);
+      // The route follows the install (`updatePlan`); a refusal is the same friendly 422.
+      // The daily background `git fetch` still running would hold `.git` locks the update's own
+      // fetch needs, and fail it as `fetch_failed`; it ends within GENESEED_NET_TIMEOUT.
+      if (state._behind?.inflight) {
+        return sendJson(res, { precondition: 'checking', kind: 'info',
+          message: 'The console is checking upstream right now. Try Update again in a moment.' },
+        422, ae);
       }
+      const plan = updatePlan(installKind());
+      if (plan.refuse) return sendJson(res, plan.refuse, 422, ae);
       // `requestRestart` declines on a foreground server, which then shows its stale banner.
-      const jid = jm.start('update', actionCommands('update'), (rc) => {
+      const jid = jm.start('update', plan.cmds, (rc) => {
         state.refresh();
-        if (rc === 0) requestRestart(state.theme);
-      });
+        if (rc === 0) {
+          // The old answers ("3 commits to pull") are about the code just replaced.
+          delete state._behind;
+          delete state._update;
+          requestRestart(state.theme);
+        }
+      }, plan.opts);
       if (jid === null) return sendJson(res, { error: 'busy' }, 409, ae);
       return sendJson(res, { job_id: jid }, 202, ae);
     }
@@ -336,10 +396,13 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     const ae = req.headers['accept-encoding'] || '';
     const path = (req.url || '').split('?', 1)[0];
     try {
+      // GUARD FIRST, BODY SECOND: a refused request is DISCARDED (`resume`, nothing buffered).
+      const refused = requestGuard(req, token);
+      if (refused) {
+        sendJson(res, refused.body, refused.code, ae);
+        return req.resume();
+      }
       if (req.method === 'GET') {
-        if (!localHost(req.headers.host)) {
-          return sendJson(res, { error: 'forbidden host' }, 403, ae);
-        }
         try {
           return doGet(req, res, path, ae);
         } catch (e) {
@@ -353,13 +416,10 @@ export function makeHandler(state, jm, token, dist, holder = null) {
         }
       }
       if (req.method === 'POST') {
-        // GUARDS FIRST, BODY SECOND. The Host and token checks need no body, so they answer
-        // before one is read — a refused request is DISCARDED (`resume`, nothing buffered), never
-        // collected. A body over `MAX_BODY` is refused on its declared length, and the socket is
-        // closed rather than drained. Otherwise the body is buffered before routing regardless
+        // The guard above needed no body, so it answered before one was read. A body over
+        // `MAX_BODY` is refused on its declared length, and the socket is closed rather than drained. Otherwise the body is buffered before routing regardless
         // of what the route needs it for: Node's parser owns the message boundary, so unread
         // bytes are discarded when the response ends rather than mis-parsed as the next request.
-        if (refusePost(req, res, ae)) return req.resume();
         const length = parseIntStrict(String(req.headers['content-length'] ?? '')) ?? 0;
         if (length > MAX_BODY) {
           res.setHeader('Connection', 'close');
@@ -377,6 +437,9 @@ export function makeHandler(state, jm, token, dist, holder = null) {
             if (e instanceof NotFound) {
               return sendJson(res, { error: `not found: ${e.message}` }, 404, ae);
             }
+            // A body the route refused on its content (a rule body with a `## ` heading) is
+            // the caller's to fix: 400, not the 500 of a server fault.
+            if (e instanceof BadRequest) return sendJson(res, { error: e.message }, 400, ae);
             return sendJson(res, { error: String(e && e.message ? e.message : e) }, 500, ae);
           }
         });