let-them-talk 3.4.1 → 3.4.2

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## [3.4.2] - 2026-03-15
+
+### Security — CSRF Protection
+- Required `X-LTT-Request` custom header on all POST/PUT/DELETE requests
+- `lttFetch` wrapper in dashboard automatically includes the header
+- Malicious cross-origin pages cannot set custom headers without CORS preflight approval
+- Removed wildcard `Access-Control-Allow-Origin: *` in LAN mode — now uses explicit trusted origins only
+- Empty Origin/Referer no longer auto-trusted — requires custom header as minimum protection
+
+### Security — LAN Auth Token
+- Auto-generated 32-char hex token when LAN mode is enabled
+- Token required for all non-localhost requests (via `?token=` query param or `X-LTT-Token` header)
+- Token included in QR code URL — phone scans and it just works
+- Token displayed in phone access modal with explanation
+- New token generated each time LAN mode is toggled on
+- Token persists across server restarts via `.lan-token` file
+- Localhost access never requires a token
+
+### Security — Content Security Policy
+- CSP header added to dashboard HTML response
+- `script-src 'unsafe-inline'` for inline handlers, blocks `eval()` and external scripts
+- `connect-src 'self'` restricts API calls to same origin
+- `font-src`, `style-src`, `img-src` scoped to required sources only
+
+### Fixed
+- CSRF brace imbalance that trapped GET handlers inside POST-only block
+- LAN token not forwarded from phone URL to API calls and SSE
+- Redundant nested origin check collapsed to single condition
+
 ## [3.4.1] - 2026-03-15
 
 ### Added

package/LICENSE

@@ -6,7 +6,7 @@ License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
 Parameters
 
 Licensor:             Dekelelz
-Licensed Work:        Let Them Talk v3.4.1
+Licensed Work:        Let Them Talk v3.4.2
                       The Licensed Work is (c) 2024-2026 Dekelelz.
 Additional Use Grant: You may make use of the Licensed Work, provided that
                       you may not use the Licensed Work for a Commercial

package/cli.js

@@ -8,7 +8,7 @@ const command = process.argv[2];
 
 function printUsage() {
   console.log(`
-  Let Them Talk — Agent Bridge v3.4.1
+  Let Them Talk — Agent Bridge v3.4.2
   MCP message broker for inter-agent communication
   Supports: Claude Code, Gemini CLI, Codex CLI
 

package/dashboard.html

@@ -2842,7 +2842,7 @@
   </div>
 </div>
 <div class="app-footer">
-  <span>Let Them Talk v3.4.1</span>
+  <span>Let Them Talk v3.4.2</span>
 </div>
 <div class="profile-popup" id="profile-popup" onclick="event.stopPropagation()">
   <div class="profile-popup-header">
@@ -2897,6 +2897,26 @@ var POLL_INTERVAL = 2000;
 var SLEEP_THRESHOLD = 60; // seconds
 var lastMessageCount = 0;
 var autoScroll = true;
+// CSRF protection — all mutating requests must include this header
+// Read LAN token from URL on page load (phone access via QR code)
+var _lttToken = (function() {
+  try { var p = new URLSearchParams(window.location.search); var t = p.get('token'); if (t) sessionStorage.setItem('ltt-token', t); return sessionStorage.getItem('ltt-token') || ''; } catch(e) { return ''; }
+})();
+
+function lttFetch(url, opts) {
+  opts = opts || {};
+  // Append LAN token to URL if present (needed for phone/LAN access)
+  if (_lttToken) {
+    var sep = url.indexOf('?') >= 0 ? '&' : '?';
+    url = url + sep + 'token=' + encodeURIComponent(_lttToken);
+  }
+  if (opts.method && opts.method !== 'GET') {
+    if (!opts.headers) opts.headers = {};
+    opts.headers['X-LTT-Request'] = '1';
+  }
+  return fetch(url, opts);
+}
+
 var activeThread = null;
 var activeProject = ''; // empty = default/local
 var cachedHistory = [];
@@ -3227,7 +3247,7 @@ function renderAgents(agents) {
 
 function sendNudge(agentName) {
   var body = JSON.stringify({ to: agentName, content: 'Hey ' + agentName + ', the user is waiting for you. Please check for new messages and continue your work.' });
-  fetch('/api/inject' + projectParam(), {
+  lttFetch('/api/inject' + projectParam(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: body
@@ -3285,7 +3305,7 @@ function doInject() {
   if (!target || !content) return;
 
   var body = JSON.stringify({ to: target, content: content });
-  fetch('/api/inject' + projectParam(), {
+  lttFetch('/api/inject' + projectParam(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: body
@@ -3612,7 +3632,7 @@ var cachedReadReceipts = {};
 
 function fetchReadReceipts() {
   var pq = activeProject ? '?project=' + encodeURIComponent(activeProject) : '';
-  fetch('/api/read-receipts' + pq).then(function(r) { return r.json(); }).then(function(data) {
+  lttFetch('/api/read-receipts' + pq).then(function(r) { return r.json(); }).then(function(data) {
     cachedReadReceipts = data || {};
   }).catch(function() {});
 }
@@ -3752,7 +3772,7 @@ function deleteMessage(msgId) {
   var preview = msg.content.substring(0, 60) + (msg.content.length > 60 ? '...' : '');
   if (!confirm('Delete this message from ' + msg.from + '?\n\n"' + preview + '"')) return;
   var pq = activeProject ? '?project=' + encodeURIComponent(activeProject) : '';
-  fetch('/api/message' + pq, {
+  lttFetch('/api/message' + pq, {
     method: 'DELETE',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ id: msgId })
@@ -3802,7 +3822,7 @@ function saveEditMessage() {
   var content = document.getElementById('edit-msg-content').value.trim();
   if (!content) return;
   var pq = activeProject ? '?project=' + encodeURIComponent(activeProject) : '';
-  fetch('/api/message' + pq, {
+  lttFetch('/api/message' + pq, {
     method: 'PUT',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ id: msgId, content: content })
@@ -3994,7 +4014,7 @@ function renderAgentStats() {
 
 function fetchActivity() {
   var pq = projectParam();
-  fetch('/api/timeline' + pq).then(function(r) { return r.json(); }).then(function(data) {
+  lttFetch('/api/timeline' + pq).then(function(r) { return r.json(); }).then(function(data) {
     renderActivityHeatmap(data);
   }).catch(function() {});
 }
@@ -4174,7 +4194,7 @@ var cachedTasks = [];
 
 function fetchTasks() {
   var pq = projectParam();
-  fetch('/api/tasks' + pq).then(function(r) { return r.json(); }).then(function(tasks) {
+  lttFetch('/api/tasks' + pq).then(function(r) { return r.json(); }).then(function(tasks) {
     cachedTasks = Array.isArray(tasks) ? tasks : [];
     renderTasks();
   }).catch(function() {
@@ -4265,7 +4285,7 @@ function buildTaskCard(t) {
 }
 
 function updateTaskStatus(taskId, newStatus) {
-  fetch('/api/tasks' + projectParam(), {
+  lttFetch('/api/tasks' + projectParam(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ task_id: taskId, status: newStatus })
@@ -4322,7 +4342,7 @@ var AGENT_COLORS = ['#58a6ff', '#f78166', '#7ee787', '#d2a8ff', '#ffa657', '#ff7
 
 function fetchStats() {
   var pq = activeProject ? '?project=' + encodeURIComponent(activeProject) : '';
-  fetch('/api/stats' + pq).then(function(r) { return r.json(); }).then(function(data) {
+  lttFetch('/api/stats' + pq).then(function(r) { return r.json(); }).then(function(data) {
     renderStats(data);
   }).catch(function(e) { console.error('Stats fetch failed:', e); });
 }
@@ -4571,7 +4591,7 @@ function saveProfile() {
   };
   if (avatar) body.avatar = avatar;
 
-  fetch('/api/profiles' + projectParam(), {
+  lttFetch('/api/profiles' + projectParam(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify(body)
@@ -4587,7 +4607,7 @@ function saveProfile() {
 
 function fetchWorkspaces() {
   var pq = projectParam();
-  fetch('/api/workspaces' + pq).then(function(r) { return r.json(); }).then(function(data) {
+  lttFetch('/api/workspaces' + pq).then(function(r) { return r.json(); }).then(function(data) {
     renderWorkspaces(data);
   }).catch(function() {});
 }
@@ -4634,7 +4654,7 @@ function renderWorkspaces(data) {
 
 function fetchWorkflows() {
   var pq = projectParam();
-  fetch('/api/workflows' + pq).then(function(r) { return r.json(); }).then(function(data) {
+  lttFetch('/api/workflows' + pq).then(function(r) { return r.json(); }).then(function(data) {
     renderWorkflows(Array.isArray(data) ? data : []);
   }).catch(function() {});
 }
@@ -4685,7 +4705,7 @@ function renderWorkflows(workflows) {
 }
 
 function dashAdvanceWorkflow(wfId) {
-  fetch('/api/workflows' + projectParam(), {
+  lttFetch('/api/workflows' + projectParam(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ action: 'advance', workflow_id: wfId })
@@ -4698,7 +4718,7 @@ var activeBranch = '';
 
 function fetchBranches() {
   var pq = projectParam();
-  fetch('/api/branches' + pq).then(function(r) { return r.json(); }).then(function(data) {
+  lttFetch('/api/branches' + pq).then(function(r) { return r.json(); }).then(function(data) {
     renderBranchTabs(data);
   }).catch(function() {});
 }
@@ -4734,7 +4754,7 @@ function switchBranch(name) {
 
 function fetchPlugins() {
   var pq = projectParam();
-  fetch('/api/plugins' + pq).then(function(r) { return r.json(); }).then(function(data) {
+  lttFetch('/api/plugins' + pq).then(function(r) { return r.json(); }).then(function(data) {
     renderPlugins(Array.isArray(data) ? data : []);
   }).catch(function() {});
 }
@@ -4761,7 +4781,7 @@ function renderPlugins(plugins) {
 }
 
 function togglePlugin(name) {
-  fetch('/api/plugins' + projectParam(), {
+  lttFetch('/api/plugins' + projectParam(), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ action: 'toggle', name: name })
@@ -4776,9 +4796,9 @@ function poll() {
   var bp = activeBranch && activeBranch !== 'main' ? '&branch=' + encodeURIComponent(activeBranch) : '';
   var pollStart = Date.now();
   Promise.all([
-    fetch('/api/history?limit=500' + pp + bp).then(function(r) { return r.json(); }),
-    fetch('/api/agents' + pq).then(function(r) { return r.json(); }),
-    fetch('/api/status' + pq).then(function(r) { return r.json(); }),
+    lttFetch('/api/history?limit=500' + pp + bp).then(function(r) { return r.json(); }),
+    lttFetch('/api/agents' + pq).then(function(r) { return r.json(); }),
+    lttFetch('/api/status' + pq).then(function(r) { return r.json(); }),
   ]).then(function(results) {
     console.log('[LTT] poll ok — history:' + results[0].length + ' agents:' + Object.keys(results[1]).length + ' project:' + (activeProject || 'default'));
     updateConnectionInfo(Date.now() - pollStart);
@@ -4834,7 +4854,7 @@ function poll() {
 
 function doReset() {
   if (!confirm('Clear all messages, agents, and history?')) return;
-  fetch('/api/reset' + projectParam(), { method: 'POST' }).then(function() {
+  lttFetch('/api/reset' + projectParam(), { method: 'POST' }).then(function() {
     lastMessageCount = 0;
     activeThread = null;
     cachedHistory = [];
@@ -4846,7 +4866,7 @@ function doReset() {
 // ==================== PROJECT MANAGEMENT ====================
 
 function loadProjects() {
-  return fetch('/api/projects').then(function(r) { return r.json(); }).then(function(projects) {
+  return lttFetch('/api/projects').then(function(r) { return r.json(); }).then(function(projects) {
     console.log('[LTT] loadProjects:', projects.length, 'projects, activeProject:', activeProject);
     var sel = document.getElementById('project-select');
     // Keep the first option (Default)
@@ -4944,7 +4964,7 @@ function addProject() {
   var projectPath = input.value.trim();
   if (!projectPath) return;
 
-  fetch('/api/projects', {
+  lttFetch('/api/projects', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ path: projectPath })
@@ -4970,7 +4990,7 @@ function discoverProjects() {
   resultsEl.style.display = 'block';
   resultsEl.innerHTML = '<div style="font-size:11px;color:var(--text-muted);padding:4px;">Scanning...</div>';
 
-  fetch('/api/discover', { method: 'POST' }).then(function(r) { return r.json(); }).then(function(found) {
+  lttFetch('/api/discover', { method: 'POST' }).then(function(r) { return r.json(); }).then(function(found) {
     if (!found.length) {
       resultsEl.innerHTML = '<div style="font-size:11px;color:var(--text-muted);padding:4px;">No new projects found (all discovered projects already added)</div>';
       setTimeout(function() { resultsEl.style.display = 'none'; }, 3000);
@@ -4996,7 +5016,7 @@ function discoverProjects() {
 }
 
 function addDiscovered(projectPath, name) {
-  fetch('/api/projects', {
+  lttFetch('/api/projects', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ path: projectPath, name: name })
@@ -5012,7 +5032,7 @@ function removeProject() {
   if (!activeProject) return;
   if (!confirm('Remove this project from the dashboard?')) return;
 
-  fetch('/api/projects', {
+  lttFetch('/api/projects', {
     method: 'DELETE',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ path: activeProject })
@@ -5275,7 +5295,7 @@ updateNotifBtn();
 var lanState = { lan_mode: false, lan_ip: null, port: 3000 };
 
 function fetchLanState() {
-  return fetch('/api/server-info').then(function(r) { return r.json(); }).then(function(info) {
+  return lttFetch('/api/server-info').then(function(r) { return r.json(); }).then(function(info) {
     lanState = info;
     updateLanUI();
     return info;
@@ -5325,7 +5345,7 @@ function toggleLanMode() {
   var content = document.getElementById('phone-modal-content');
   content.innerHTML = '<div class="phone-off-state"><p>Switching...</p></div>';
 
-  fetch('/api/toggle-lan', { method: 'POST' })
+  lttFetch('/api/toggle-lan', { method: 'POST' })
     .then(function(r) { return r.json(); })
     .then(function(info) {
       lanState = info;
@@ -5353,10 +5373,20 @@ function renderPhoneModalContent() {
   }
 
   var url = 'http://' + lanState.lan_ip + ':' + lanState.port;
-  // Include active project so the phone shows the same view
-  if (activeProject) url += '?project=' + encodeURIComponent(activeProject);
+  // Include auth token and active project so the phone shows the same view
+  var params = [];
+  if (lanState.lan_token) params.push('token=' + encodeURIComponent(lanState.lan_token));
+  if (activeProject) params.push('project=' + encodeURIComponent(activeProject));
+  if (params.length) url += '?' + params.join('&');
   var qrUrl = 'https://api.qrserver.com/v1/create-qr-code/?size=180x180&color=58a6ff&bgcolor=0d1117&data=' + encodeURIComponent(url);
 
+  var tokenHtml = lanState.lan_token ?
+    '<div style="margin-top:12px;background:var(--surface-2);border:1px solid var(--border);border-radius:8px;padding:10px">' +
+      '<div style="font-size:10px;color:var(--text-muted);text-transform:uppercase;letter-spacing:0.5px;margin-bottom:4px">Auth Token</div>' +
+      '<div style="font-family:monospace;font-size:13px;color:var(--accent);word-break:break-all">' + escapeHtml(lanState.lan_token) + '</div>' +
+      '<div style="font-size:10px;color:var(--text-muted);margin-top:4px">Included in the QR code URL. Only people with this token can access your dashboard.</div>' +
+    '</div>' : '';
+
   el.innerHTML =
     '<div class="phone-url-box">' +
       '<div class="phone-url-text">' + escapeHtml(url) + '</div>' +
@@ -5365,12 +5395,16 @@ function renderPhoneModalContent() {
     '<div class="phone-qr">' +
       '<img src="' + qrUrl + '" alt="QR Code" onerror="this.parentElement.style.display=\'none\'">' +
     '</div>' +
-    '<div class="phone-qr-hint">Scan with your phone camera on the same WiFi</div>';
+    '<div class="phone-qr-hint">Scan with your phone camera on the same WiFi</div>' +
+    tokenHtml;
 }
 
 function copyPhoneUrl() {
   var url = 'http://' + lanState.lan_ip + ':' + lanState.port;
-  if (activeProject) url += '?project=' + encodeURIComponent(activeProject);
+  var params = [];
+  if (lanState.lan_token) params.push('token=' + encodeURIComponent(lanState.lan_token));
+  if (activeProject) params.push('project=' + encodeURIComponent(activeProject));
+  if (params.length) url += '?' + params.join('&');
   navigator.clipboard.writeText(url).then(function() {
     var btn = document.querySelector('.phone-url-copy');
     btn.textContent = 'Copied!';
@@ -5389,7 +5423,7 @@ var selectedCli = 'claude';
 function renderLaunchPanel() {
   var el = document.getElementById('launch-area');
   // Fetch templates
-  fetch('/api/templates').then(function(r) { return r.json(); }).then(function(templates) {
+  lttFetch('/api/templates').then(function(r) { return r.json(); }).then(function(templates) {
     launchTemplates = templates;
     var templateOpts = '<option value="">-- No template --</option>';
     for (var i = 0; i < templates.length; i++) {
@@ -5436,8 +5470,8 @@ function renderLaunchPanel() {
 }
 
 // ==================== v3.4: CONVERSATION TEMPLATES ====================
-function renderConversationTemplates(p){fetch('/api/conversation-templates').then(function(r){return r.json()}).then(function(t){if(!t.length)return;var s=document.createElement('div');s.className='launch-panel';s.style.marginTop='20px';var h='<h3 style="margin-bottom:4px">Conversation Templates</h3><p style="font-size:12px;color:var(--text-dim);margin-bottom:16px">Pre-built multi-agent workflows. Click to see agent prompts.</p><div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:12px">';for(var i=0;i<t.length;i++){var c=t[i];var n=c.agents.map(function(a){return a.name}).join(', ');h+='<div style="background:var(--surface-2);border:1px solid var(--border);border-radius:8px;padding:14px;cursor:pointer;transition:all 0.15s" onclick="showConvTemplate(\''+escapeHtml(c.id)+'\')" onmouseover="this.style.borderColor=\'var(--accent)\'" onmouseout="this.style.borderColor=\'var(--border)\'"><div style="font-weight:600;font-size:13px;margin-bottom:4px">'+escapeHtml(c.name)+'</div><div style="font-size:11px;color:var(--text-dim);margin-bottom:8px">'+escapeHtml(c.description)+'</div><div style="font-size:10px;color:var(--text-muted)">Agents: '+escapeHtml(n)+'</div>'+(c.workflow?'<div style="font-size:10px;color:var(--purple);margin-top:4px">Workflow: '+escapeHtml(c.workflow.steps.join(' \u2192 '))+'</div>':'')+'</div>'}h+='</div><div id="conv-template-detail" style="margin-top:16px"></div>';s.innerHTML=h;p.appendChild(s)}).catch(function(){})}
-function showConvTemplate(tid){var pq=activeProject?'?project='+encodeURIComponent(activeProject):'';fetch('/api/conversation-templates/launch'+pq,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({template_id:tid})}).then(function(r){return r.json()}).then(function(d){if(d.error){alert(d.error);return}var el=document.getElementById('conv-template-detail');var h='<div style="background:var(--surface);border:1px solid var(--border);border-radius:8px;padding:16px"><div style="font-weight:700;font-size:15px;margin-bottom:4px">'+escapeHtml(d.template.name)+'</div><div style="font-size:12px;color:var(--text-dim);margin-bottom:12px">'+escapeHtml(d.template.description)+'</div>';if(d.template.workflow){h+='<div style="display:flex;gap:6px;align-items:center;margin-bottom:14px;flex-wrap:wrap">';var st=d.template.workflow.steps;for(var s=0;s<st.length;s++){if(s>0)h+='<span style="color:var(--text-muted);font-size:12px">\u2192</span>';h+='<span style="background:var(--purple-dim);color:var(--purple);padding:3px 10px;border-radius:12px;font-size:11px;font-weight:600">'+escapeHtml(st[s])+'</span>'}h+='</div>'}h+='<div style="font-weight:600;font-size:12px;color:var(--text-muted);text-transform:uppercase;letter-spacing:0.5px;margin-bottom:8px">Agent Prompts (copy each into a separate terminal)</div>';for(var i=0;i<d.instructions.length;i++){var inst=d.instructions[i];h+='<div style="margin-bottom:10px"><div style="display:flex;align-items:center;gap:8px;margin-bottom:4px"><span style="font-weight:600;font-size:13px">'+escapeHtml(inst.agent_name)+'</span><span class="role-badge">'+escapeHtml(inst.role)+'</span></div><div class="copy-block" onclick="copyText(this)" data-text="'+inst.prompt.replace(/&/g,'&amp;').replace(/"/g,'&quot;').replace(/</g,'&lt;').replace(/>/g,'&gt;')+'"><span class="copy-hint">click to copy</span><span style="font-size:11px;color:var(--text-dim)">'+escapeHtml(inst.prompt.substring(0,200))+(inst.prompt.length>200?'...':'')+'</span></div></div>'}h+='</div>';el.innerHTML=h;el.scrollIntoView({behavior:'smooth',block:'nearest'})})}
+function renderConversationTemplates(p){lttFetch('/api/conversation-templates').then(function(r){return r.json()}).then(function(t){if(!t.length)return;var s=document.createElement('div');s.className='launch-panel';s.style.marginTop='20px';var h='<h3 style="margin-bottom:4px">Conversation Templates</h3><p style="font-size:12px;color:var(--text-dim);margin-bottom:16px">Pre-built multi-agent workflows. Click to see agent prompts.</p><div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:12px">';for(var i=0;i<t.length;i++){var c=t[i];var n=c.agents.map(function(a){return a.name}).join(', ');h+='<div style="background:var(--surface-2);border:1px solid var(--border);border-radius:8px;padding:14px;cursor:pointer;transition:all 0.15s" onclick="showConvTemplate(\''+escapeHtml(c.id)+'\')" onmouseover="this.style.borderColor=\'var(--accent)\'" onmouseout="this.style.borderColor=\'var(--border)\'"><div style="font-weight:600;font-size:13px;margin-bottom:4px">'+escapeHtml(c.name)+'</div><div style="font-size:11px;color:var(--text-dim);margin-bottom:8px">'+escapeHtml(c.description)+'</div><div style="font-size:10px;color:var(--text-muted)">Agents: '+escapeHtml(n)+'</div>'+(c.workflow?'<div style="font-size:10px;color:var(--purple);margin-top:4px">Workflow: '+escapeHtml(c.workflow.steps.join(' \u2192 '))+'</div>':'')+'</div>'}h+='</div><div id="conv-template-detail" style="margin-top:16px"></div>';s.innerHTML=h;p.appendChild(s)}).catch(function(){})}
+function showConvTemplate(tid){var pq=activeProject?'?project='+encodeURIComponent(activeProject):'';lttFetch('/api/conversation-templates/launch'+pq,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({template_id:tid})}).then(function(r){return r.json()}).then(function(d){if(d.error){alert(d.error);return}var el=document.getElementById('conv-template-detail');var h='<div style="background:var(--surface);border:1px solid var(--border);border-radius:8px;padding:16px"><div style="font-weight:700;font-size:15px;margin-bottom:4px">'+escapeHtml(d.template.name)+'</div><div style="font-size:12px;color:var(--text-dim);margin-bottom:12px">'+escapeHtml(d.template.description)+'</div>';if(d.template.workflow){h+='<div style="display:flex;gap:6px;align-items:center;margin-bottom:14px;flex-wrap:wrap">';var st=d.template.workflow.steps;for(var s=0;s<st.length;s++){if(s>0)h+='<span style="color:var(--text-muted);font-size:12px">\u2192</span>';h+='<span style="background:var(--purple-dim);color:var(--purple);padding:3px 10px;border-radius:12px;font-size:11px;font-weight:600">'+escapeHtml(st[s])+'</span>'}h+='</div>'}h+='<div style="font-weight:600;font-size:12px;color:var(--text-muted);text-transform:uppercase;letter-spacing:0.5px;margin-bottom:8px">Agent Prompts (copy each into a separate terminal)</div>';for(var i=0;i<d.instructions.length;i++){var inst=d.instructions[i];h+='<div style="margin-bottom:10px"><div style="display:flex;align-items:center;gap:8px;margin-bottom:4px"><span style="font-weight:600;font-size:13px">'+escapeHtml(inst.agent_name)+'</span><span class="role-badge">'+escapeHtml(inst.role)+'</span></div><div class="copy-block" onclick="copyText(this)" data-text="'+inst.prompt.replace(/&/g,'&amp;').replace(/"/g,'&quot;').replace(/</g,'&lt;').replace(/>/g,'&gt;')+'"><span class="copy-hint">click to copy</span><span style="font-size:11px;color:var(--text-dim)">'+escapeHtml(inst.prompt.substring(0,200))+(inst.prompt.length>200?'...':'')+'</span></div></div>'}h+='</div>';el.innerHTML=h;el.scrollIntoView({behavior:'smooth',block:'nearest'})})}
 
 function selectCli(cli) {
   selectedCli = cli;
@@ -5471,7 +5505,7 @@ function doLaunch() {
   var prompt = document.getElementById('launch-prompt').value.trim();
   var resultEl = document.getElementById('launch-result');
 
-  fetch('/api/launch', {
+  lttFetch('/api/launch', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ cli: selectedCli, project_dir: projectDir || undefined, agent_name: agentName, prompt: prompt || undefined })
@@ -5539,7 +5573,8 @@ function setConnStatus(status) {
 
 function initSSE() {
   try {
-    var eventSource = new EventSource('/api/events');
+    var sseUrl = '/api/events' + (_lttToken ? '?token=' + encodeURIComponent(_lttToken) : '');
+    var eventSource = new EventSource(sseUrl);
     eventSource.onmessage = function(e) {
       if (e.data === 'update' || e.data === 'connected') {
         poll();

package/dashboard.js

@@ -18,6 +18,26 @@ const PORT = parseInt(process.env.AGENT_BRIDGE_PORT || '3000', 10);
 const LAN_STATE_FILE = path.join(__dirname, '.lan-mode');
 let LAN_MODE = process.env.AGENT_BRIDGE_LAN === 'true' || (fs.existsSync(LAN_STATE_FILE) && fs.readFileSync(LAN_STATE_FILE, 'utf8').trim() === 'true');
 
+const LAN_TOKEN_FILE = path.join(__dirname, '.lan-token');
+let LAN_TOKEN = null;
+
+function generateLanToken() {
+  const crypto = require('crypto');
+  LAN_TOKEN = crypto.randomBytes(16).toString('hex');
+  try { fs.writeFileSync(LAN_TOKEN_FILE, LAN_TOKEN); } catch {}
+  return LAN_TOKEN;
+}
+
+function loadLanToken() {
+  if (fs.existsSync(LAN_TOKEN_FILE)) {
+    try { LAN_TOKEN = fs.readFileSync(LAN_TOKEN_FILE, 'utf8').trim(); } catch {}
+  }
+  if (!LAN_TOKEN) generateLanToken();
+}
+
+// Load or generate token on startup
+loadLanToken();
+
 function persistLanMode() {
   try { fs.writeFileSync(LAN_STATE_FILE, LAN_MODE ? 'true' : 'false'); } catch {}
 }
@@ -1009,13 +1029,15 @@ const server = http.createServer(async (req, res) => {
 
   const allowedOrigin = `http://localhost:${PORT}`;
   const reqOrigin = req.headers.origin;
-  if (LAN_MODE && reqOrigin) {
-    res.setHeader('Access-Control-Allow-Origin', '*');
-  } else if (reqOrigin === allowedOrigin || reqOrigin === `http://127.0.0.1:${PORT}`) {
+  const lanIP = getLanIP();
+  const lanOrigin = lanIP ? `http://${lanIP}:${PORT}` : null;
+  const trustedOrigins = [allowedOrigin, `http://127.0.0.1:${PORT}`];
+  if (LAN_MODE && lanOrigin) trustedOrigins.push(lanOrigin);
+  if (reqOrigin && trustedOrigins.includes(reqOrigin)) {
     res.setHeader('Access-Control-Allow-Origin', reqOrigin);
   }
   res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-LTT-Request, X-LTT-Token');
 
   if (req.method === 'OPTIONS') {
     res.writeHead(204);
@@ -1023,7 +1045,23 @@ const server = http.createServer(async (req, res) => {
     return;
   }
 
-  // CSRF + DNS rebinding protection: validate Host and Origin on mutating requests
+  // LAN auth token — required for non-localhost requests when LAN mode is active
+  if (LAN_MODE) {
+    const host = (req.headers.host || '').replace(/:\d+$/, '');
+    const isLocalhost = host === 'localhost' || host === '127.0.0.1';
+    if (!isLocalhost) {
+      const tokenFromQuery = url.searchParams.get('token');
+      const tokenFromHeader = req.headers['x-ltt-token'];
+      const providedToken = tokenFromHeader || tokenFromQuery;
+      if (!providedToken || providedToken !== LAN_TOKEN) {
+        res.writeHead(401, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Unauthorized: invalid or missing LAN token' }));
+        return;
+      }
+    }
+  }
+
+  // CSRF + DNS rebinding protection: validate Host, Origin, and custom header on mutating requests
   if (req.method === 'POST' || req.method === 'PUT' || req.method === 'DELETE') {
     // Check Host header to block DNS rebinding attacks
     const host = (req.headers.host || '').replace(/:\d+$/, '');
@@ -1034,13 +1072,26 @@ const server = http.createServer(async (req, res) => {
       res.end(JSON.stringify({ error: 'Forbidden: invalid host' }));
       return;
     }
+    // Require custom header — browsers block cross-origin custom headers without preflight,
+    // which our CORS policy won't approve for foreign origins. This closes the no-Origin gap.
+    if (!req.headers['x-ltt-request']) {
+      res.writeHead(403, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Forbidden: missing X-LTT-Request header' }));
+      return;
+    }
     // Check Origin header to block cross-site requests
+    // Empty origin is NOT trusted — requires at least the custom header (checked above)
     const origin = req.headers.origin || '';
     const referer = req.headers.referer || '';
     const source = origin || referer;
-    const isLocal = !source || source.includes('localhost:' + PORT) || source.includes('127.0.0.1:' + PORT);
-    const isLan = LAN_MODE && getLanIP() && source.includes(getLanIP() + ':' + PORT);
-    if (!isLocal && !isLan) {
+    if (!source) {
+      // No origin/referer — non-browser client (curl, scripts, etc.)
+      // Custom header check above is the only protection layer here — allow through
+      // since local CLI tools (like our own `msg` command) need to work
+    }
+    const isLocal = source && (source.includes('localhost:' + PORT) || source.includes('127.0.0.1:' + PORT));
+    const isLan = LAN_MODE && getLanIP() && source && source.includes(getLanIP() + ':' + PORT);
+    if (source && !isLocal && !isLan) {
       res.writeHead(403, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'Forbidden: invalid origin' }));
       return;
@@ -1074,6 +1125,7 @@ const server = http.createServer(async (req, res) => {
       const html = fs.readFileSync(HTML_FILE, 'utf8');
       res.writeHead(200, {
         'Content-Type': 'text/html; charset=utf-8',
+        'Content-Security-Policy': "default-src 'self'; script-src 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'",
         'Cache-Control': 'no-cache, no-store, must-revalidate',
         'Pragma': 'no-cache',
         'Expires': '0'
@@ -1321,7 +1373,7 @@ const server = http.createServer(async (req, res) => {
     // Server info (LAN mode detection for frontend)
     else if (url.pathname === '/api/server-info' && req.method === 'GET') {
       res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ lan_mode: LAN_MODE, lan_ip: getLanIP(), port: PORT }));
+      res.end(JSON.stringify({ lan_mode: LAN_MODE, lan_ip: getLanIP(), port: PORT, lan_token: LAN_MODE ? LAN_TOKEN : null }));
     }
     // Toggle LAN mode (re-bind server live)
     else if (url.pathname === '/api/toggle-lan' && req.method === 'POST') {
@@ -1329,9 +1381,11 @@ const server = http.createServer(async (req, res) => {
       const lanIP = getLanIP();
       LAN_MODE = newMode;
       persistLanMode();
+      // Regenerate token when enabling LAN mode
+      if (newMode) generateLanToken();
       // Send response first
       res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ lan_mode: newMode, lan_ip: lanIP, port: PORT }));
+      res.end(JSON.stringify({ lan_mode: newMode, lan_ip: lanIP, port: PORT, lan_token: newMode ? LAN_TOKEN : null }));
       // Re-bind by stopping the listener and immediately re-listening
       // Use setImmediate to let the response flush first
       setImmediate(() => {
@@ -1447,7 +1501,7 @@ server.listen(PORT, LAN_MODE ? '0.0.0.0' : '127.0.0.1', () => {
   const dataDir = resolveDataDir();
   const lanIP = getLanIP();
   console.log('');
-  console.log('  Let Them Talk - Agent Bridge Dashboard v3.4.1');
+  console.log('  Let Them Talk - Agent Bridge Dashboard v3.4.2');
   console.log('  ============================================');
   console.log('  Dashboard:  http://localhost:' + PORT);
   if (LAN_MODE && lanIP) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "let-them-talk",
-  "version": "3.4.1",
+  "version": "3.4.2",
   "description": "MCP message broker + web dashboard for inter-agent communication. Let AI CLI agents talk to each other.",
   "main": "server.js",
   "bin": {

package/server.js

@@ -2097,7 +2097,7 @@ async function main() {
   loadPlugins();
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  console.error('Agent Bridge MCP server v3.4.1 running (' + (27 + loadedPlugins.length) + ' tools)');
+  console.error('Agent Bridge MCP server v3.4.2 running (' + (27 + loadedPlugins.length) + ' tools)');
 }
 
 main().catch(console.error);