great-cto 3.77.0 → 3.78.1

package/board/packages/board/server.mjs

@@ -12,9 +12,9 @@ import http from 'http';
 import fs from 'fs';
 import path from 'path';
 import { spawnSync } from 'child_process';
-import { PORT, PUBLIC, HOST } from './lib/config.mjs';
+import { PORT, PUBLIC, HOST, bindRefusal } from './lib/config.mjs';
 import { warmTasksAsync } from './lib/beads.mjs';
-import { originAllowed, hostAllowed, parseAllowedHosts, isInsideDir } from './lib/util.mjs';
+import { originAllowed, corsOriginFor, crossSiteRead, hostAllowed, parseAllowedHosts, isInsideDir } from './lib/util.mjs';
 import { discoverProjects, resolveProjectInfo } from './lib/projects.mjs';
 import { startAlertCron } from './lib/alerts.mjs';
 import { watchBeads, watchVerdicts, watchAgentEvents } from './lib/watchers.mjs';
@@ -73,10 +73,26 @@ const server = http.createServer(async (req, res) => {
     res.setHeader('X-Project-Resolved', projInfo.resolved);
   }
 
-  // CORS
-  res.setHeader('Access-Control-Allow-Origin', '*');
-  // Expose our debug headers to browsers (CORS hides custom headers by default)
+  // CORS: only the board's own origins. This was `*`, so any page open in the same
+  // browser could read the API. Vary keeps a cache from serving one origin's answer
+  // to another.
+  res.setHeader('Vary', 'Origin');
+  // Expose our debug headers to browsers (CORS hides custom headers by default).
+  // Sent on every answer: without Access-Control-Allow-Origin it grants nothing,
+  // and a client that checks the list must not find it missing.
   res.setHeader('Access-Control-Expose-Headers', 'X-Project-Fallback, X-Project-Resolved, X-Project-Serving');
+  const corsOrigin = corsOriginFor(req);
+  if (corsOrigin) res.setHeader('Access-Control-Allow-Origin', corsOrigin);
+
+  // ── Cross-site reads ────────────────────────────────────────────────────────
+  // Withholding the CORS header stops a page reading the answer; the request still
+  // arrives and still runs. The API and the event stream are refused outright.
+  // The page itself (`/`) stays reachable: a link in an alert email is cross-site.
+  if (pathname.startsWith('/api/') && crossSiteRead(req)) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'cross-origin request blocked — the board API answers only its own page and local tools' }));
+    return;
+  }
 
   // ── CSRF guard (BH-31) ──────────────────────────────────────────────────────
   // The board binds 127.0.0.1, but a page the user visits in their browser can still
@@ -128,11 +144,16 @@ const server = http.createServer(async (req, res) => {
 });
 
 // ── Start ──────────────────────────────────────────────────────────────────────
+const refusal = bindRefusal();
+if (refusal) {
+  log.error(refusal);
+  process.exit(1);
+}
 server.listen(PORT, HOST, () => {
   log.info(`great_cto board → http://${HOST === '0.0.0.0' ? 'localhost' : HOST}:${PORT}`);
-  if (HOST !== '127.0.0.1' && HOST !== 'localhost') {
-    log.info(`  ⚠ bound to ${HOST} — reachable beyond this machine. Operators authenticate via invite`);
-    log.info(`    links; put your reverse-proxy auth in front for anything admin-grade.`);
+  if (bindRefusal(HOST, {}, []) !== null) {
+    log.info(`  ⚠ bound to ${HOST} — reachable beyond this machine. The board has no login of its own:`);
+    log.info(`    you stated that authentication sits in front of it (GREAT_CTO_BOARD_BEHIND_AUTH / --behind-auth).`);
   }
   if (['0.0.0.0', '::'].includes(HOST) && parseAllowedHosts().length === 0) {
     log.info(`  ⚠ bound to ${HOST} with no GREAT_CTO_ALLOWED_HOSTS — only localhost / 127.0.0.1 names are answered.`);

package/dist/main.js

@@ -815,9 +815,11 @@ ${bold("Board:")}
 ${bold("Operator console (the second surface — invite-only, hostable):")}
   great-cto console                 Serve ONLY the operator console (no dev board)
   great-cto console --port 8788     Different port
-  great-cto console --bind 0.0.0.0  Reachable beyond this machine (tunnel/hosting);
-                                    operators sign in via invite links. Only names you
-                                    list are answered: GREAT_CTO_ALLOWED_HOSTS=console.example.com
+  great-cto console --bind 0.0.0.0  Reachable beyond this machine (tunnel/hosting).
+                                    There is no login: put authentication in front and set
+                                    GREAT_CTO_BOARD_BEHIND_AUTH=1, or the server refuses to start.
+                                    Only names you list are answered:
+                                    GREAT_CTO_ALLOWED_HOSTS=console.example.com
 
 ${bold("Telemetry (anonymous, opt-IN — OFF by default):")}
   great-cto telemetry status   Show state + endpoint + your anon_id

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.77.0",
+  "version": "3.78.1",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",