mulmoterminal 2.0.0 → 2.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mulmoterminal",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "MulmoTerminal — browser terminal + GUI panel for Claude Code. One command to start.",
   "type": "module",
   "license": "MIT",

package/server/backends/google.ts

@@ -54,7 +54,7 @@ const liveDeps: GoogleRouteDeps = {
 };
 
 interface GoogleRouteOptions {
-  isAllowedOrigin: (origin?: string) => boolean;
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean;
 }
 
 const failed = (res: Response, cause: unknown, fallback: string): void => {
@@ -81,7 +81,7 @@ async function readStatus(deps: GoogleRouteDeps): Promise<GoogleStatus> {
 // it, any site the user visits could POST /unlink and silently drop their account link.
 export function mountGoogleRoutes(app: Express, { isAllowedOrigin }: GoogleRouteOptions, deps: GoogleRouteDeps = liveDeps): void {
   const forbidden = (req: Request, res: Response): boolean => {
-    if (isAllowedOrigin(req.headers.origin)) return false;
+    if (isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) return false;
     res.status(403).json({ error: "forbidden origin" });
     return true;
   };

package/server/backends/remoteHost/index.ts

@@ -93,7 +93,7 @@ export function initRemoteHostBackend(deps: RemoteHostBackendDeps): void {
 }
 
 export interface RemoteHostRouteOptions {
-  isAllowedOrigin: (origin?: string) => boolean;
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean;
 }
 
 export function mountRemoteHostRoutes(app: Express, { isAllowedOrigin }: RemoteHostRouteOptions): void {

package/server/backends/remoteHost/routes.ts

@@ -28,7 +28,7 @@ interface ErrorResponse {
 type RemoteHostResponse = StatusResponse | ErrorResponse;
 
 export interface RemoteHostRouteDeps {
-  isAllowedOrigin: (origin?: string) => boolean;
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean;
   getLifecycle: () => RemoteHostLifecycle | null;
   exportSession: () => string | null;
   // 401 for a genuinely expired/invalid blob (client drops it), 5xx for a transient
@@ -53,7 +53,7 @@ export function mountRemoteHostRoutes(app: Express, deps: RemoteHostRouteDeps):
   // Origin-guarded (loopback only) + not-initialized guard. Returns the live lifecycle
   // (already sent the error response and returns null when either guard fails).
   const guard = (req: Request, res: Response<RemoteHostResponse>): RemoteHostLifecycle | null => {
-    if (!deps.isAllowedOrigin(req.headers.origin)) {
+    if (!deps.isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) {
       res.status(403).json({ error: "forbidden origin" });
       return null;
     }

package/server/config/env.ts

@@ -6,6 +6,19 @@ import path from "node:path";
 
 export const PORT = process.env.PORT || 34567;
 
+// The interface the HTTP server binds to. LOOPBACK BY DEFAULT — this server has no
+// authentication of its own: every /api route, the terminal WebSockets, and the routes that
+// spawn a PTY are reachable by anyone who can open a socket to it. Binding every interface
+// (Node's default when `listen()` is given no host) put all of that on the local network.
+//
+// It is also what several guards silently depend on: `isAllowedOrigin` trusts a request with
+// no Origin header, on the grounds that such a caller is a local CLI or MCP tool rather than
+// a browser. That reasoning only holds while nothing remote can connect at all.
+//
+// Set MULMOTERMINAL_HOST to widen it deliberately — `0.0.0.0` to accept from anywhere, or a
+// specific address. Only on a network you trust, and knowing the above.
+export const BIND_HOST = process.env.MULMOTERMINAL_HOST || "127.0.0.1";
+
 // The workspace used as the PTY cwd and as the root for persisted session state. index.ts
 // creates it at boot before anything spawns into it.
 export const CLAUDE_CWD = process.env.CLAUDE_CWD || path.join(os.homedir(), "mulmoclaude");

package/server/files/dirRequest.ts

@@ -7,8 +7,12 @@ import { isRecord } from "../../common/isRecord.js";
 // absolute, existing. Returns the directory, or null after sending the matching
 // error response — so the caller just does `const dir = resolveDirRequest(...); if (!dir) return;`.
 // Shared by the local-only /api/open-dir and /api/git-remote routes.
-export function resolveDirRequest(req: Request, res: Response, isAllowedOrigin: (origin?: string) => boolean): string | null {
-  if (!isAllowedOrigin(req.headers.origin)) {
+export function resolveDirRequest(
+  req: Request,
+  res: Response,
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean,
+): string | null {
+  if (!isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) {
     res.status(403).json({ error: "forbidden origin" });
     return null;
   }

package/server/files/open-dir.ts

@@ -12,7 +12,7 @@ export function openCommand(platform: NodeJS.Platform): string {
 }
 
 interface OpenDirOptions {
-  isAllowedOrigin: (origin?: string) => boolean;
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean;
 }
 
 // POST /api/open-dir { path } — reveal an absolute, existing directory in the OS

package/server/files/pick-file.ts

@@ -55,7 +55,7 @@ export function parsePickerOutput(stdout: string): string[] {
 }
 
 interface PickFileOptions {
-  isAllowedOrigin: (origin?: string) => boolean;
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean;
 }
 
 // POST /api/pick-file — open the OS file dialog and return the chosen absolute
@@ -64,7 +64,7 @@ interface PickFileOptions {
 // { paths: [] }. Same-origin guarded like the other local-action routes.
 export function mountPickFileRoute(app: Express, { isAllowedOrigin }: PickFileOptions) {
   app.post("/api/pick-file", (req: Request, res) => {
-    if (!isAllowedOrigin(req.headers.origin)) return res.status(403).json({ error: "forbidden origin" });
+    if (!isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) return res.status(403).json({ error: "forbidden origin" });
     const directory = isRecord(req.body) && req.body.directory === true;
     const { cmd, args } = pickFileCommand(process.platform, directory);
     const child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });

package/server/git/gitRemote.ts

@@ -50,7 +50,7 @@ export function resolveGithubUrl(dir: string): Promise<string | null> {
 }
 
 interface GitRemoteOptions {
-  isAllowedOrigin: (origin?: string) => boolean;
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean;
 }
 
 // POST /api/git-remote { path } -> { githubUrl: string | null }. Lets the browser

package/server/git/worktree-routes.ts

@@ -8,7 +8,7 @@ import { worktreeDiff } from "./worktree-diff.js";
 import { pushWorktree, createOrOpenPR } from "./worktree-pr.js";
 
 interface WorktreeRouteOptions {
-  isAllowedOrigin: (origin?: string) => boolean;
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean;
 }
 
 // A failed git/gh command is a 500; a precondition the user can fix (no remote, not
@@ -41,7 +41,7 @@ export function mountWorktreeRoutes(app: Express, { isAllowedOrigin }: WorktreeR
   });
 
   app.post("/api/worktrees/create", async (req, res) => {
-    if (!isAllowedOrigin(req.headers.origin)) return res.status(403).end();
+    if (!isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) return res.status(403).end();
     const { repoDir, task } = req.body ?? {};
     if (typeof repoDir !== "string" || typeof task !== "string" || !task.trim()) {
       return res.status(400).json({ error: "repoDir and a non-empty task are required" });
@@ -55,7 +55,7 @@ export function mountWorktreeRoutes(app: Express, { isAllowedOrigin }: WorktreeR
   // re-confirms with `force`; not-managed → a bad path), 500 for an internal git
   // failure the client can't fix by retrying.
   app.post("/api/worktrees/remove", async (req, res) => {
-    if (!isAllowedOrigin(req.headers.origin)) return res.status(403).end();
+    if (!isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) return res.status(403).end();
     const { repoDir, path: worktreePath, deleteBranch, force } = req.body ?? {};
     if (typeof repoDir !== "string" || typeof worktreePath !== "string") {
       return res.status(400).json({ error: "repoDir and path are required" });
@@ -70,7 +70,7 @@ export function mountWorktreeRoutes(app: Express, { isAllowedOrigin }: WorktreeR
 
   // Push the worktree's branch to origin (the first half of "取り込み").
   app.post("/api/worktrees/push", async (req, res) => {
-    if (!isAllowedOrigin(req.headers.origin)) return res.status(403).end();
+    if (!isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) return res.status(403).end();
     const { cwd } = req.body ?? {};
     if (typeof cwd !== "string") return res.status(400).json({ error: "cwd is required" });
     const result = await pushWorktree(cwd);
@@ -80,7 +80,7 @@ export function mountWorktreeRoutes(app: Express, { isAllowedOrigin }: WorktreeR
   // Push, then create a PR via gh — or fall back to the GitHub compare URL. The body
   // returns the URL for the client to open and which path produced it (`via`).
   app.post("/api/worktrees/pr", async (req, res) => {
-    if (!isAllowedOrigin(req.headers.origin)) return res.status(403).end();
+    if (!isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) return res.status(403).end();
     const { cwd } = req.body ?? {};
     if (typeof cwd !== "string") return res.status(400).json({ error: "cwd is required" });
     const result = await createOrOpenPR(cwd);

package/server/index.ts

@@ -25,7 +25,8 @@ import {
 import { sandboxEnabled, sandboxPlatformSupported, dockerAvailable, ensureSandboxImage } from "./infra/sandbox.js";
 import { isAllowedOrigin } from "./infra/allowed-origin.js";
 import { serverErrorExit } from "./infra/server-exit.js";
-import { PORT, CLAUDE_CWD, MULMOTERMINAL_HOME, SESSION_ID_RE } from "./config/env.js";
+import { PORT, BIND_HOST, CLAUDE_CWD, MULMOTERMINAL_HOME, SESSION_ID_RE } from "./config/env.js";
+import { isLoopbackBinding } from "./infra/loopback.js";
 import { messageOf } from "./errors.js";
 import { hookSettingsJson } from "./session/hook-settings.js";
 import { mcpConfigJson } from "./session/mcp-config.js";
@@ -556,8 +557,16 @@ server.on("error", (err) => {
   process.exit(code);
 });
 
-server.listen(PORT, () => {
+// Number(): PORT comes from the environment as a string, and the (port, host, cb) overload
+// takes a number — the (port, cb) form we used before accepted either.
+server.listen(Number(PORT), BIND_HOST, () => {
   console.log(`mulmoterminal running at http://localhost:${PORT}`);
+  if (!isLoopbackBinding(server.address())) {
+    console.warn(
+      `\x1b[33m[security]\x1b[0m bound to ${BIND_HOST}, not loopback — this server has no authentication, ` +
+        `so anyone who can reach ${BIND_HOST}:${PORT} can read your sessions and start terminals. Unset MULMOTERMINAL_HOST to bind 127.0.0.1.`,
+    );
+  }
   const surviving = tmuxAvailable() ? tmuxListSessionIds() : [];
   if (tmuxAvailable()) {
     const detail = surviving.length ? ` — ${surviving.length} session(s) survived; reattach on connect` : "";

package/server/infra/allowed-origin.ts

@@ -1,9 +1,14 @@
 // Which browser origins may open this server's sockets and reach its privileged routes.
 //
 // Only same-machine browser origins, so a malicious website the user happens to visit can't
-// drive the local Claude PTY (a cross-site WebSocket hijack). A MISSING Origin is allowed —
-// that is a non-browser local client, which cannot be a cross-site request. Any localhost
-// host on any port is allowed, which is what covers the Vite dev proxy.
+// drive the local Claude PTY (a cross-site WebSocket hijack). A MISSING Origin is allowed when
+// the peer is on this machine — that is a non-browser local client (CLI, MCP tool, curl), which
+// cannot be a cross-site request. Any localhost host on any port is allowed, which is what
+// covers the Vite dev proxy.
+//
+// The peer check matters because "it must be local" used to be inferred from the bind address
+// alone. Nothing enforced that, and the server in fact listened on every interface, so a remote
+// client sending no Origin was trusted outright.
 //
 // Out of index.ts because every route module and the pub/sub socket take this as a
 // dependency and every one of their tests passes a stub, so the real predicate — the single
@@ -12,10 +17,26 @@
 //
 // `hostname` is what `new URL()` normalises to, so an IPv6 literal arrives bracketed
 // (`[::1]`) however it was written, and a host is already lower-cased and punycoded.
+import { isLoopbackAddress } from "./loopback.js";
+
 const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
 
-export function isAllowedOrigin(origin?: string): boolean {
-  if (!origin) return true;
+// `remoteAddress` is the socket's peer, and it is REQUIRED — not because every caller has one,
+// but because a caller that forgets it silently falls back to trusting a missing Origin, which
+// is the whole defect this parameter exists to close. A caller that genuinely cannot know (the
+// socket.io CORS callback, which is handed no request) writes `undefined` at the call site,
+// where the reader can see the gap instead of inferring it from an absent argument.
+//
+// A PRESENT Origin is still judged on the origin alone, peer or not. That is deliberate: the
+// origin check defends against a BROWSER being driven cross-site, and a browser cannot forge
+// the header. A non-browser that forges it must already be able to reach the port, which only
+// happens when the operator widened the bind — an explicit decision to trust whoever can
+// connect. Making a non-loopback peer fail outright here would break the one setup that opt-in
+// exists for (a container or WSL forwarding a port, where the peer is the bridge).
+export function isAllowedOrigin(origin: string | undefined, remoteAddress: string | undefined): boolean {
+  // No Origin means a non-browser caller — a CLI, an MCP tool, curl. Trustworthy only because
+  // it is on this machine; a remote one is precisely what this must not wave through.
+  if (!origin) return remoteAddress === undefined || isLoopbackAddress(remoteAddress);
   try {
     return LOOPBACK_HOSTNAMES.has(new URL(origin).hostname);
   } catch {

package/server/infra/loopback.ts

@@ -0,0 +1,40 @@
+// Is a peer address on this machine?
+//
+// The one thing several guards ultimately rest on. The server binds to loopback by default
+// (see BIND_HOST in config/env.ts), and code that treats a request as trusted because
+// "remote traffic can't reach us" is only correct while that holds — a deployment that opts
+// into a wider bind, or any proxy in front, breaks the assumption silently. Asking the socket
+// is the only answer that stays true either way.
+//
+// Node reports an IPv4 peer on a dual-stack listener as `::ffff:127.0.0.1`, so the mapped
+// form is unwrapped before comparing: matching the bare literals alone would classify a real
+// loopback client as remote. The whole 127.0.0.0/8 block is loopback, not just 127.0.0.1.
+export function isLoopbackAddress(address: string | undefined | null): boolean {
+  if (!address) return false;
+  const bare = address.startsWith("::ffff:") ? address.slice("::ffff:".length) : address;
+  if (bare === "::1" || bare === "0:0:0:0:0:0:0:1") return true;
+  return LOOPBACK_V4.test(bare);
+}
+
+// 127.0.0.0/8, with each octet actually in range — `127.999.0.1` is not an address. The peer
+// form comes from the kernel and could not be out of range, but isLoopbackBindHost below runs
+// this over a value the operator typed.
+const OCTET = "(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)";
+const LOOPBACK_V4 = new RegExp(`^127\\.${OCTET}\\.${OCTET}\\.${OCTET}$`);
+
+// Whether the server ended up listening only on this machine, from what the OS says it bound —
+// `server.address()` — rather than from the string that was requested.
+//
+// Classifying the requested string cannot be made right: `localhost`, `127.1`, `127.0.1` and
+// `127.000.000.001` are all valid ways to ask for loopback, and `localhost` can be pointed
+// somewhere else entirely by a hosts file. Asking after the fact answers all of them, because
+// the kernel has already resolved whatever was typed. A warning that fires on a safe setting
+// trains people to ignore the one that matters, so it has to be exact.
+//
+// A string address is a pipe or UNIX socket — no network exposure. A null means the server is
+// not listening, so there is nothing to warn about yet.
+export function isLoopbackBinding(address: string | { address: string } | null): boolean {
+  if (address === null) return true;
+  if (typeof address === "string") return true;
+  return isLoopbackAddress(address.address);
+}

package/server/infra/pubsub.ts

@@ -12,16 +12,19 @@ export interface Publisher {
   publish(channel: string, data: unknown): void;
 }
 
-export function createPubSub(server: HttpServer, isAllowedOrigin: (origin?: string) => boolean = () => true) {
+export function createPubSub(server: HttpServer, isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean = () => true) {
   const io = new IOServer(server, {
     path: "/ws/pubsub",
     transports: ["websocket"],
     // Reject cross-origin connections so an untrusted website can't subscribe to
     // session activity. allowRequest covers the websocket handshake; cors covers
     // any polling/preflight.
-    allowRequest: (req, cb) => cb(null, isAllowedOrigin(req.headers.origin)),
+    allowRequest: (req, cb) => cb(null, isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)),
     cors: {
-      origin: (origin, cb) => cb(null, isAllowedOrigin(origin)),
+      // Socket.IO hands this callback no request, so there is genuinely no peer to check —
+      // spelled out rather than omitted. allowRequest above gates the actual handshake and
+      // does see the socket, so this covers only polling/preflight.
+      origin: (origin, cb) => cb(null, isAllowedOrigin(origin, undefined)),
       credentials: true,
     },
   });

package/server/infra/tmux-routes.ts

@@ -4,7 +4,7 @@ import type { Express } from "express";
 // orphan-selection boundary are unit-testable without booting the server (mirrors
 // gitRemote / open-dir / command-summary).
 export interface TmuxRouteDeps {
-  isAllowedOrigin: (origin?: string) => boolean;
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean;
   isValidSessionId: (id: string) => boolean;
   // Reap a live session (kills its pty + tmux + cleanup); a no-op without a live entry.
   reapSession: (id: string) => void;
@@ -35,7 +35,7 @@ export function mountTmuxRoutes(app: Express, deps: TmuxRouteDeps): void {
   // leaving it for the disconnect grace. Works even when the WS is down, and kills a tmux
   // orphaned by a prior server restart (reap alone is a no-op without a live entry).
   app.post("/api/session/:id/terminate", (req, res) => {
-    if (!deps.isAllowedOrigin(req.headers.origin)) return res.status(403).json({ error: "forbidden origin" });
+    if (!deps.isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) return res.status(403).json({ error: "forbidden origin" });
     const id = req.params.id;
     if (!deps.isValidSessionId(id)) return res.status(400).json({ error: "invalid session id" });
     deps.reapSession(id); // live entry → kills pty + tmux + cleanup
@@ -47,7 +47,7 @@ export function mountTmuxRoutes(app: Express, deps: TmuxRouteDeps): void {
   // resumable (a persisted grid session, or a Claude/Codex transcript on disk). These
   // accumulate across server restarts, which the in-memory reap bookkeeping can't reach.
   app.post("/api/tmux/cleanup-orphans", async (req, res) => {
-    if (!deps.isAllowedOrigin(req.headers.origin)) return res.status(403).json({ error: "forbidden origin" });
+    if (!deps.isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) return res.status(403).json({ error: "forbidden origin" });
     const isResumable = await deps.resumablePredicate();
     const killed: string[] = [];
     for (const id of deps.listTmuxIds()) {

package/server/routes/app-routes.ts

@@ -9,6 +9,7 @@
 // What arrives as deps is what index.ts owns: the spawners, the session lifecycle, the title
 // manager, the tool stores, and `publish` (pub/sub exists only once the HTTP server does).
 import path from "node:path";
+import { sameOriginGuard } from "./same-origin-guard.js";
 import express, { type Express } from "express";
 import { mountAllRoutes } from "../infra/plugins-registry.js";
 import { mountConfigRoutes } from "../config/config-routes.js";
@@ -56,7 +57,7 @@ import { SPA_FALLBACK_RE } from "../infra/spa-fallback.js";
 
 export interface AppRouteDeps extends SessionActivityDeps {
   clientDir: string;
-  isAllowedOrigin: (origin: string | undefined) => boolean;
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean;
   publish: (channel: string, data: unknown) => void;
   sessionChannel: (id: string) => string;
   toolStores: ReturnType<typeof createToolStores>;
@@ -75,6 +76,11 @@ export function mountAppRoutes(app: Express, deps: AppRouteDeps): void {
   const clientDir = deps.clientDir;
   app.use(express.json({ limit: "25mb" }));
 
+  // Before any route: one same-origin gate for every state-changing request, so a site the
+  // user visits cannot drive this server through their browser. Individual routes keep their
+  // own checks — this is the floor, not a replacement.
+  app.use(sameOriginGuard(deps.isAllowedOrigin));
+
   // The GUI-plugin tool routes this server answers itself: spawnBackgroundChat,
   // manageAccounting, manageCollection (routes/plugin-routes.ts). ALL of them must precede
   // mountAllRoutes' /api/plugin/:toolName catch-all below, which would otherwise take them.

package/server/routes/same-origin-guard.ts

@@ -0,0 +1,42 @@
+import type { NextFunction, Request, Response } from "express";
+
+// A single same-origin gate for every state-changing request, instead of each route
+// remembering to ask.
+//
+// Why it is needed even though the server binds to loopback: loopback is reachable from the
+// user's OWN browser, so a site they happen to visit can POST to http://localhost:34567. It
+// cannot READ the reply cross-origin, but the side effect still happens — and among these
+// routes are ones that spawn an agent, rewrite the config, and write files. Per-route guards
+// covered some of that surface and not the rest, which is the failure mode a central gate
+// removes: a route added tomorrow is covered by default rather than by memory.
+//
+// Safe methods are left alone — but not because they are guaranteed side-effect free. Gating
+// them by origin would achieve nothing: a cross-site `<img src=http://localhost:.../>` sends NO
+// Origin header, exactly like a legitimate local fetch, so the predicate cannot tell them
+// apart. It would only break the media loads that cannot send a header.
+//
+// That makes "a GET must not change anything" a rule this file relies on and cannot enforce.
+// One route already bends it: GET /api/session/:id calls freshenRosterTitle, which may spawn
+// an LLM title generation. It is rate-limited and needs a server-generated session UUID the
+// caller would have to know, so the cost of the bend is small — but a NEW side effect added to
+// a GET is unprotected by anything here, and belongs in a POST.
+const STATE_CHANGING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+
+// The one deliberate cross-origin caller: a custom collection view is LLM-authored HTML in a
+// sandboxed iframe, so its origin is opaque (`null`) by construction. It carries its own
+// HMAC-signed capability token, scoped to one slug and to read/write — a stronger check than
+// origin, and the reason these paths must not be judged by origin at all.
+const VIEW_DATA = /^\/api\/collections\/[^/]+\/view-data(\/|$)/;
+
+export function needsSameOrigin(method: string, path: string): boolean {
+  if (!STATE_CHANGING.has(method.toUpperCase())) return false;
+  return !VIEW_DATA.test(path);
+}
+
+export function sameOriginGuard(isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean) {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    if (!needsSameOrigin(req.method, req.path)) return next();
+    if (isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) return next();
+    res.status(403).json({ error: "forbidden origin" });
+  };
+}

package/server/routes/ws-routes.ts

@@ -38,7 +38,7 @@ export interface WsRouteDeps {
   /** The http server these endpoints hang their `upgrade` handler off. */
   server: Server;
   /** Only same-machine browser origins may open a terminal socket. */
-  isAllowedOrigin: (origin: string | undefined) => boolean;
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean;
   claudeBin: string;
   setWaiting: (id: string, waiting: boolean) => void;
   reattachPty: (entry: PtyEntry, ws: WebSocket, sessionId: string) => PtyEntry;
@@ -369,7 +369,7 @@ export function mountTerminalWebSockets(deps: WsRouteDeps) {
     // socket.io is entitled to.
     if (!kind) return;
     const target = serverFor[kind];
-    if (!deps.isAllowedOrigin(req.headers.origin)) {
+    if (!deps.isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) {
       console.warn(`[ws] rejected cross-origin upgrade from ${req.headers.origin}`);
       socket.destroy();
       return;

package/server/session/command-summary.ts

@@ -136,7 +136,7 @@ export async function summarizeLog(log: string, deps: SummarizeDeps = {}): Promi
 }
 
 interface CommandSummaryDeps {
-  isAllowedOrigin: (origin?: string) => boolean;
+  isAllowedOrigin: (origin: string | undefined, remoteAddress: string | undefined) => boolean;
 }
 
 // POST /api/command/summarize { log } -> { summary, truncated }. Same-origin guarded
@@ -144,7 +144,7 @@ interface CommandSummaryDeps {
 // local `claude` binary. Mirrors mountPickFileRoute's shape.
 export function mountCommandSummaryRoute(app: Express, { isAllowedOrigin }: CommandSummaryDeps): void {
   app.post("/api/command/summarize", async (req: Request, res) => {
-    if (!isAllowedOrigin(req.headers.origin)) return res.status(403).json({ error: "forbidden origin" });
+    if (!isAllowedOrigin(req.headers.origin, req.socket?.remoteAddress)) return res.status(403).json({ error: "forbidden origin" });
     const body = isRecord(req.body) ? req.body : {};
     if (typeof body.log !== "string") return res.status(400).json({ error: "body.log (string) required" });
     try {