partforge 0.40.0 → 0.44.0

package/src/{testing → framework/oracle}/verify.js

@@ -3,9 +3,9 @@ import { measure as defaultMeasure } from "./measure.js";
 import { pairKey, CONTACT_EPS } from "./gaps.js";
 import { resolveProfile } from "./dfm-profiles.js";
 import { expandCases } from "./cases.js";
-import { subPartReadKeys, relevanceHash, RELEVANT_ALL } from "../framework/param-deps.js";
-import { resolveParams } from "../framework/jobs.js";
-import { SUBPART_METRICS, VIEW_METRICS } from "../framework/verify-metrics.js";
+import { subPartReadKeys, relevanceHash, RELEVANT_ALL } from "../param-deps.js";
+import { resolveParams } from "../part-model.js";
+import { SUBPART_METRICS, VIEW_METRICS } from "../verify-metrics.js";
 
 // Re-exported for backwards compatibility: the registries moved to framework/ so
 // the linter can read the metric vocabulary without importing a geometry kernel.
@@ -118,14 +118,23 @@ function check(scope, subpart, metric, spec, registry, factsObj) {
   if (actual === null || actual === undefined) {
     if (reg.manifoldOnly) return { ...base, actual, status: "skip", pass: null, message: "n/a (OCCT backend)" };
     if (metric === "minWall") {
-      return { ...base, actual, status: "warn", pass: null, message: "min wall unavailable",
+      const out = { ...base, actual, status: "warn", pass: null, message: "min wall unavailable",
         hint: partHint ?? "no min-wall reading for this mesh — treat thin features as unverified" };
+      // A missing reading still has a HOW: a sampled run whose rays all missed says
+      // so here, rather than reading like a mesh min-wall never looked at.
+      const note = reg.note?.(factsObj);
+      if (note) out.note = note;
+      return out;
     }
     return { ...base, actual, status: "skip", pass: null, message: "unavailable" };
   }
   const { pass, message } = evaluateAssertion(parseAssertion(expr), actual);
   const status = pass ? "pass" : reg.kind === "warn" ? "warn" : "fail";
   const out = { ...base, actual, status, pass, message };
+  // A measurement caveat rides along whatever the verdict — a min-wall reading
+  // taken from a sample still passed, but the reader should know it was a sample.
+  const note = reg.note?.(factsObj);
+  if (note) out.note = note;
   if (!pass) {
     out.hint = partHint ?? reg.hint;
     if (reg.pattern) out.pattern = reg.pattern;
@@ -158,7 +167,10 @@ export function evaluateCase(facts, { profile, expect, subPartNames }) {
   return checks;
 }
 
-export function verify(kernel, part, { process, view, measureFn = defaultMeasure } = {}) {
+// `seed` lets a caller that has ALREADY measured this part hand the result in so
+// verify does not recompute it — see the seeding block below for the shape and
+// the one correctness rule that governs it.
+export function verify(kernel, part, { process, view, measureFn = defaultMeasure, seed } = {}) {
   view = view ?? Object.keys(part.views)[0];
   const profileSpec = process ?? part.verify?.process;
   const profile = profileSpec ? resolveProfile(profileSpec) : null;
@@ -185,6 +197,50 @@ export function verify(kernel, part, { process, view, measureFn = defaultMeasure
       : [...readKeys.entries()].map(([name, keys]) => `${name}:${relevanceHash([...keys], params)}`).join("|");
 
   const memo = new Map();
+
+  // SEEDING. expandCases always yields a "defaults" case, and the inspect job
+  // (framework/jobs.js) measures those exact params immediately before calling
+  // verify — so without this the oracle rebuilds the same geometry, casts the
+  // same min-wall rays and re-indexes the same meshes a second time. On a
+  // single-case part that is half the job.
+  //   seed = { params, result } — the params the result was measured with, and
+  //   the measure() output itself. Nothing else: every fact the rule below needs
+  //   is read off the artifact, so a caller cannot assert it wrongly.
+  //
+  // THE MIN-WALL SUPERSET RULE, which is the trap here. measureCase asks for
+  // `{ minWall: needMinWall }`, and needMinWall is false whenever no profile and
+  // no expectation mentions min wall. A result measured WITH min wall is a strict
+  // superset of one measured without: the extra fields are only ever read by the
+  // minWall metric, which by definition this run never checks. Reuse in that
+  // direction is free. The reverse is NOT safe — a seed taken without min wall
+  // carries `minWall: null` on every sub-part, which the registry reports as
+  // "min wall unavailable", silently downgrading a real gate to a warning. So the
+  // seed is consulted only when `seed.result.measuredMinWall || !needMinWall` —
+  // and `measuredMinWall` is stamped by measure() itself, not claimed by whoever
+  // holds the result. Otherwise the seed is ignored and the case measured properly.
+  //
+  // ALIASING. A consulted seed is memoized BY REFERENCE, so the caller's result
+  // and every case that hits it are the same object — the inspect job's
+  // `report.measure` and `report.verify.cases[0]`'s facts included. Nothing here
+  // mutates facts (evaluateCase only reads), and that is what makes the sharing
+  // safe; a future check that wants to annotate a fact must copy first.
+  //
+  // Keyed through the SAME signature() the memo uses, never a JSON compare of the
+  // raw params — a separate compare would miss cases that share a signature (a
+  // preset touching only params the build never reads) and, worse, could hit on
+  // params that merely look equal. The seed's params are layered over
+  // part.defaults first because a caller's `{}` and the defaults case's
+  // `{...part.defaults}` build identical geometry but hash differently
+  // (JSON.stringify({}) is not JSON.stringify(defaults), and relevanceHash reads
+  // params[k] straight through). The view is checked too: measure()'s output is
+  // per-view, and a seed from another view would be a silent wrong answer.
+  //
+  // Non-default measure options (a custom `gapThreshold`) are the caller's
+  // responsibility: seed only a measurement taken the way verify would take it.
+  if (seed?.result && (seed.result.measuredMinWall || !needMinWall) && seed.result.view === view) {
+    memo.set(signature({ ...part.defaults, ...(seed.params ?? {}) }), seed.result);
+  }
+
   const measureCase = (params) => {
     const key = signature(params);
     if (!memo.has(key)) memo.set(key, measureFn(kernel, part, view, params, { minWall: needMinWall }));

package/src/framework/param-deps.js

@@ -3,7 +3,7 @@
 // affect what's visible. Pure — no DOM, no real geometry (reuses the geometry-free
 // probe kernel). Errs toward RELEVANT_ALL whenever it can't analyze a build.
 import { createProbeKernel } from "./geometry/probe.js";
-import { viewSubParts } from "./jobs.js";
+import { viewSubParts } from "./part-model.js";
 import { resolveDerived } from "./derive.js";
 
 export const RELEVANT_ALL = Symbol("relevant-all");

package/src/framework/part-model.js

@@ -0,0 +1,48 @@
+// The pure part model: which sub-parts a view shows, which of those are exportable,
+// how a part's params resolve, and how one posed sub-part solid is built. No async,
+// no worker protocol, no kernel boot — just synchronous functions over a
+// PartDefinition, a kernel handle, and params.
+//
+// Deliberately a LEAF of the framework graph. buildPosed is the single definition of
+// "a posed sub-part solid", so the worker job loop (jobs.js), the collision check
+// (assembly.js), the relevance probe (param-deps.js), and the headless oracle
+// (oracle/) all call it. Keeping those four functions out of jobs.js — which is
+// async, imports the kernels, and pulls in the whole export stack — is what lets the
+// oracle depend on the part model without an import cycle back through the job loop.
+import { resolveDerived } from "./derive.js";
+
+// Names of the sub-parts a view shows: declared in the view and enabled for these
+// params. Order follows Object.keys(part.parts) (definition order).
+export function viewSubParts(part, view, params) {
+  return Object.keys(part.parts).filter((name) => {
+    const sp = part.parts[name];
+    const inView = sp.views.includes(view);
+    const on = sp.enabled ? !!sp.enabled(params) : true;
+    return inView && on;
+  });
+}
+
+// Sub-parts to include in an EXPORT of this view: the visible sub-parts, minus any
+// flagged `exportable: false` (reference/preview-only parts — motor ghosts, bearing
+// placeholders, etc.). They still show in the viewer; they're just never written to
+// an STL/STEP/3MF file, so the user never has to toggle them off before exporting.
+export function exportSubParts(part, view, params) {
+  return viewSubParts(part, view, params).filter((name) => part.parts[name].exportable !== false);
+}
+
+// Resolve a part's effective params + derived values for a build: the user's params
+// layered over the part defaults, and derive() run once over the result.
+export function resolveParams(part, params) {
+  const p = { ...part.defaults, ...params };
+  return { p, d: resolveDerived(part, p) };
+}
+
+// Build one sub-part and apply its optional place() for the given purpose/view.
+// `p`/`d` come from resolveParams(). This is the SINGLE definition of "a posed
+// sub-part solid" — the worker, the collision check, and the test harness all call
+// it, so display/export poses can never drift between the app and its tests.
+export function buildPosed(kernel, part, name, { purpose, view, p, d, onProgress } = {}) {
+  const sp = part.parts[name];
+  const solid = sp.build(kernel, p, d, onProgress);
+  return sp.place ? sp.place(solid, { view, purpose, p, d }) : solid;
+}

package/src/framework/pick-request/client.js

@@ -4,18 +4,26 @@
 // user is working with an agent.
 import { createPromptBanner } from "./prompt-banner.js";
 import { formatSelection } from "../selection/format.js";
+import { PICK_SERVER_DEFAULT_URL } from "./endpoint.js";
 
-export function createPickRequestClient({ serverUrl = "http://127.0.0.1:4518", viewer, part, getContext }) {
+export function createPickRequestClient({ serverUrl = PICK_SERVER_DEFAULT_URL, token = "", viewer, part, getContext }) {
   let active = null; // { id, index } of the agent prompt we're waiting on
   const banner = createPromptBanner({ viewer, part, getContext });
 
+  // Every route on the pick-server is token-gated. POSTs carry it as a header;
+  // EventSource cannot set headers, so the stream carries it in the query string.
   const postJson = (path, body) =>
     fetch(`${serverUrl}${path}`, {
-      method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body),
+      method: "POST",
+      headers: { "content-type": "application/json", ...(token ? { "x-pick-token": token } : {}) },
+      body: JSON.stringify(body),
     }).catch(() => banner.message("⚠ couldn't reach pick-server — click not sent"));
 
   // --- agent prompts over SSE -------------------------------------------------
-  const es = new globalThis.EventSource(`${serverUrl}/events`);
+  const eventsUrl = token
+    ? `${serverUrl}/events?token=${encodeURIComponent(token)}`
+    : `${serverUrl}/events`;
+  const es = new globalThis.EventSource(eventsUrl);
   es.addEventListener("prompt", (e) => {
     const v = JSON.parse(e.data);
     active = { id: v.id, index: v.index };

package/src/framework/pick-request/endpoint.js

@@ -0,0 +1,60 @@
+// Shared constants + loopback checks for request-a-pick. Deliberately free of both
+// node: imports and DOM access: the browser client, mount.js, the Node server, and
+// the CLI all need these, and the browser side must never pull in node:http.
+//
+// Why loopback matters: the pick-server streams the agent's prompts and receives the
+// user's selection (including live parameter values). Both ends must be pinned to the
+// local machine — an arbitrary `?pickserver=https://evil.example` would ship every
+// click off-box, and an arbitrary reflected CORS origin would let any page the user
+// visits read the stream.
+export const PICK_SERVER_DEFAULT_PORT = 4518;
+export const PICK_SERVER_DEFAULT_TIMEOUT_MS = 120000;
+export const PICK_SERVER_DEFAULT_HOST = "127.0.0.1";
+export const PICK_SERVER_DEFAULT_URL = `http://${PICK_SERVER_DEFAULT_HOST}:${PICK_SERVER_DEFAULT_PORT}`;
+
+// The whole 127/8 block plus the IPv6 loopback and the `localhost` name. Anything
+// else (including 0.0.0.0 and names that merely resolve to 127.0.0.1) is rejected —
+// a DNS name is exactly the DNS-rebinding vector we are guarding against.
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "::1", "[::1]"]);
+const isLoopbackHostname = (h) =>
+  LOOPBACK_HOSTNAMES.has(h) || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
+
+// `origin` is an HTTP Origin header value: scheme://host[:port], no path.
+export function isLoopbackOrigin(origin) {
+  if (typeof origin !== "string" || origin === "") return false;
+  let u;
+  try { u = new URL(origin); } catch { return false; }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return false;
+  return isLoopbackHostname(u.hostname);
+}
+
+// `host` is an HTTP Host header value: host[:port], no scheme. A Host that names
+// anything but loopback means the request arrived through a rebound DNS name.
+export function isLoopbackHost(host, port) {
+  if (typeof host !== "string" || host === "") return false;
+  let u;
+  try { u = new URL(`http://${host}`); } catch { return false; }
+  if (!isLoopbackHostname(u.hostname)) return false;
+  // An explicit port must be ours; a bare host means port 80, which we never bind.
+  return u.port !== "" && Number(u.port) === Number(port);
+}
+
+export function isLoopbackUrl(url) {
+  if (typeof url !== "string" || url === "") return false;
+  let u;
+  try { u = new URL(url); } catch { return false; }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return false;
+  return isLoopbackHostname(u.hostname);
+}
+
+// Normalise a user-supplied `?pickserver=` value to an origin we are willing to talk
+// to. Anything non-loopback falls back to the default and reports why, so a tampered
+// URL degrades to "talks to the local server" rather than "exfiltrates every click".
+export function resolvePickServerUrl(raw, { onReject } = {}) {
+  if (typeof raw !== "string" || raw === "") return PICK_SERVER_DEFAULT_URL;
+  if (!isLoopbackUrl(raw)) {
+    onReject?.(raw);
+    return PICK_SERVER_DEFAULT_URL;
+  }
+  return raw.replace(/\/+$/, ""); // paths are appended verbatim; no double slash
+}

package/src/framework/pick-request/index.js

@@ -1 +1,7 @@
 export { createPickRequestClient } from "./client.js";
+// Browser-safe half of the endpoint contract (no node: imports) — mount.js needs the
+// loopback check and the default URL, and must not reach into the Node server module.
+export {
+  resolvePickServerUrl, isLoopbackUrl,
+  PICK_SERVER_DEFAULT_PORT, PICK_SERVER_DEFAULT_URL,
+} from "./endpoint.js";

package/src/framework/pick-request/server.js

@@ -1,26 +1,155 @@
 // src/framework/pick-request/server.js
 // The Node side of request-a-pick: an http+SSE server holding one active batch,
 // a blocking CLI client (requestPicks), and CLI output formatting. 127.0.0.1 only.
+//
+// Threat model. While this is listening, any page the developer visits can reach
+// http://127.0.0.1:<port> from their browser. Everything here exists to make that
+// harmless:
+//   * a per-process bearer token gates every route (the browser gets it through the
+//     app URL, the CLI through ~/.partforge/pick-<port>.token),
+//   * Origin is never reflected unless it is loopback, and `*` is never emitted, so
+//     a foreign page cannot read the SSE stream or any response,
+//   * Host must name loopback, so a rebound DNS name pointing at 127.0.0.1 is refused,
+//   * bodies are capped, and
+//   * /resolve payloads are shape-checked and stripped of control characters before
+//     they can reach the agent's stdout — that print is a prompt-injection channel.
 import { createServer, request as httpRequest } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createBatch, view, resolve, cancel, timeout, result } from "./batch.js";
 import { formatSelection } from "../selection/format.js";
+import {
+  PICK_SERVER_DEFAULT_PORT, PICK_SERVER_DEFAULT_TIMEOUT_MS, PICK_SERVER_DEFAULT_HOST,
+  isLoopbackOrigin, isLoopbackHost,
+} from "./endpoint.js";
 
-const json = (res, code, obj, origin) => {
-  res.writeHead(code, { "content-type": "application/json", "access-control-allow-origin": origin || "*" });
+export {
+  PICK_SERVER_DEFAULT_PORT, PICK_SERVER_DEFAULT_TIMEOUT_MS, PICK_SERVER_DEFAULT_HOST,
+  PICK_SERVER_DEFAULT_URL,
+} from "./endpoint.js";
+
+const MAX_BODY_BYTES = 256 * 1024;   // no route needs more; anything bigger is abuse
+const MAX_SELECTION_CHARS = 16 * 1024;
+const MAX_STRING_CHARS = 512;
+const MAX_PARAM_KEYS = 200;
+const MAX_PROMPTS = 32;
+const MAX_PROMPT_CHARS = 2000;
+
+// Control characters (plus the Unicode line separators) are what let injected text
+// forge extra CLI lines in the agent's stdout. Fold them to spaces rather than drop
+// them, so "a\nb" cannot silently become the single token "ab".
+const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g;
+export const sanitizeText = (s, max = MAX_STRING_CHARS) =>
+  String(s).replace(CONTROL_CHARS, " ").slice(0, max);
+
+export function mintPickToken() {
+  return randomBytes(32).toString("base64url");
+}
+
+const tokenMatches = (given, expected) => {
+  const a = Buffer.from(typeof given === "string" ? given : "");
+  const b = Buffer.from(expected);
+  return a.length === b.length && timingSafeEqual(a, b);
+};
+
+// EventSource cannot set headers, so the token must also be accepted in the query
+// string; POSTs prefer a header. Both are equally secret — the URL never leaves the
+// machine.
+const tokenFrom = (req, query) => {
+  const header = req.headers["x-pick-token"];
+  if (typeof header === "string" && header) return header;
+  const auth = req.headers.authorization;
+  if (typeof auth === "string" && /^bearer\s+/i.test(auth)) return auth.replace(/^bearer\s+/i, "").trim();
+  return query.get("token") ?? "";
+};
+
+const isVec3 = (v) => Array.isArray(v) && v.length === 3
+  && v.every((n) => typeof n === "number" && Number.isFinite(n));
+
+// Whitelist the Selection shape resolveSelection() produces. Unknown keys are dropped
+// rather than passed through: whatever survives here is printed to the agent, so the
+// set of things that can reach it must be closed, not open.
+function sanitizeSelection(selection) {
+  if (!selection || typeof selection !== "object" || Array.isArray(selection)) {
+    return { error: "selection must be an object" };
+  }
+  let encoded;
+  try { encoded = JSON.stringify(selection); } catch { return { error: "selection is not serialisable" }; }
+  if (!encoded || encoded.length > MAX_SELECTION_CHARS) return { error: "selection too large" };
+  if (typeof selection.subPart !== "string") return { error: "selection.subPart must be a string" };
+
+  const out = { subPart: sanitizeText(selection.subPart) };
+  for (const key of ["point", "normal"]) {
+    if (selection[key] === undefined) continue;
+    if (!isVec3(selection[key])) return { error: `selection.${key} must be 3 finite numbers` };
+    out[key] = [...selection[key]];
+  }
+  if (selection.params !== undefined) {
+    const p = selection.params;
+    if (!p || typeof p !== "object" || Array.isArray(p)) return { error: "selection.params must be an object" };
+    const keys = Object.keys(p);
+    if (keys.length > MAX_PARAM_KEYS) return { error: "selection.params has too many keys" };
+    out.params = {};
+    for (const k of keys) {
+      const v = p[k];
+      const ok = (typeof v === "number" && Number.isFinite(v)) || typeof v === "boolean" || v === null
+        || typeof v === "string";
+      if (!ok) return { error: `selection.params.${sanitizeText(k, 40)} must be a primitive` };
+      out.params[sanitizeText(k, 80)] = typeof v === "string" ? sanitizeText(v) : v;
+    }
+  }
+  if (selection.feature !== undefined) {
+    const f = selection.feature;
+    if (!f || typeof f !== "object" || Array.isArray(f) || typeof f.label !== "string") {
+      return { error: "selection.feature must be { label }" };
+    }
+    out.feature = { label: sanitizeText(f.label) };
+  }
+  return { selection: out };
+}
+
+function sanitizePrompts(prompts) {
+  if (!Array.isArray(prompts) || prompts.length === 0) return { error: "prompts must be a non-empty array" };
+  if (prompts.length > MAX_PROMPTS) return { error: "prompts must be a non-empty array of at most 32 strings" };
+  if (!prompts.every((p) => typeof p === "string")) return { error: "prompts must be a non-empty array of strings" };
+  return { prompts: prompts.map((p) => sanitizeText(p, MAX_PROMPT_CHARS)) };
+}
+
+const corsHeaders = (allowOrigin) => (allowOrigin
+  // `vary` because the same URL answers differently per Origin — never let a cache
+  // hand a foreign page a response minted for the local app.
+  ? { "access-control-allow-origin": allowOrigin, vary: "origin" }
+  : { vary: "origin" });
+
+const json = (res, code, obj, allowOrigin) => {
+  res.writeHead(code, { "content-type": "application/json", ...corsHeaders(allowOrigin) });
   res.end(JSON.stringify(obj));
 };
+
 const readBody = (req) => new Promise((resolve_) => {
   let b = "";
-  req.on("data", (c) => (b += c));
+  let size = 0;
+  let settled = false;
+  const settle = (v) => { if (!settled) { settled = true; resolve_(v); } };
+  req.on("data", (c) => {
+    if (settled) return;
+    size += c.length;
+    if (size > MAX_BODY_BYTES) { settle({ _tooLarge: true }); return; }
+    b += c;
+  });
   req.on("end", () => {
-    if (!b) { resolve_({}); return; }
-    try { resolve_(JSON.parse(b)); } catch { resolve_({ _parseError: true }); }
+    if (!b) { settle({}); return; }
+    try { settle(JSON.parse(b)); } catch { settle({ _parseError: true }); }
   });
+  req.on("error", () => settle({ _parseError: true }));
 });
 
-export function createPickServer({ port = 4518, timeoutMs = 120000 } = {}) {
+export function createPickServer({
+  port = PICK_SERVER_DEFAULT_PORT,
+  timeoutMs = PICK_SERVER_DEFAULT_TIMEOUT_MS,
+  token = mintPickToken(),
+} = {}) {
   let batch = null;        // the one active batch (or null)
-  let pending = null;      // { res, timer } — the held POST /request response
+  let pending = null;      // { res, timer, allowOrigin } — the held POST /request response
   const sseClients = new Set();
   const allSockets = new Set(); // track every socket for forceful teardown
 
@@ -30,34 +159,66 @@ export function createPickServer({ port = 4518, timeoutMs = 120000 } = {}) {
   const finish = () => {                 // resolve the held /request with the result
     if (pending) {
       clearTimeout(pending.timer);
-      json(pending.res, 200, result(batch));
+      json(pending.res, 200, result(batch), pending.allowOrigin);
       pending = null;
     }
     sse("cleared", {});
     batch = null;
   };
 
+  // The body was over the cap. readBody already stopped buffering, so memory is
+  // bounded; drain the rest so the 413 reaches the client cleanly instead of being
+  // RST'd away by an immediate destroy, and hang up on anyone still streaming after.
+  const tooLarge = (req, res, allowOrigin) => {
+    req.resume();
+    res.writeHead(413, { "content-type": "application/json", connection: "close", ...corsHeaders(allowOrigin) });
+    res.end(JSON.stringify({ error: "body too large" }));
+    const kill = setTimeout(() => { if (!req.readableEnded) req.destroy(); }, 250);
+    kill.unref?.(); // a pending hang-up must never hold the process open
+    req.on("end", () => clearTimeout(kill));
+  };
+
   const server = createServer(async (req, res) => {
+    const bound = server.address()?.port ?? port;
+    // 1. DNS-rebinding guard. A foreign name that resolves to 127.0.0.1 still carries
+    //    its own Host, so this refuses the request before any state is touched.
+    if (!isLoopbackHost(req.headers.host, bound)) return json(res, 400, { error: "bad host" }, null);
+
+    // 2. Origin. Absent means a native client (the CLI); present must be loopback. An
+    //    arbitrary origin is never reflected, and `*` is never emitted.
     const origin = req.headers.origin;
+    if (origin !== undefined && !isLoopbackOrigin(origin)) {
+      return json(res, 403, { error: "origin not allowed" }, null);
+    }
+    const allowOrigin = origin ?? null;
+
+    // 3. Preflight is answered before the token check on purpose: browsers never put
+    //    credentials on an OPTIONS, and a 401 here would mask the real error.
     if (req.method === "OPTIONS") {
       res.writeHead(204, {
-        "access-control-allow-origin": origin || "*",
+        ...corsHeaders(allowOrigin),
         "access-control-allow-methods": "GET,POST,OPTIONS",
-        "access-control-allow-headers": "content-type",
+        "access-control-allow-headers": "content-type,authorization,x-pick-token",
+        "access-control-max-age": "600",
       });
       return res.end();
     }
-    const url = req.url.split("?")[0];
 
-    if (req.method === "POST" && url === "/request") {
-      if (batch) return json(res, 409, { status: "busy" }, origin);
+    const [path, rawQuery = ""] = req.url.split("?");
+    // 4. Token on every route.
+    if (!tokenMatches(tokenFrom(req, new URLSearchParams(rawQuery)), token)) {
+      return json(res, 401, { error: "unauthorized" }, allowOrigin);
+    }
+
+    if (req.method === "POST" && path === "/request") {
+      if (batch) return json(res, 409, { status: "busy" }, allowOrigin);
       const body = await readBody(req);
-      if (body._parseError) return json(res, 400, { error: "invalid JSON" }, origin);
-      if (!Array.isArray(body.prompts) || body.prompts.length === 0) {
-        return json(res, 400, { error: "prompts must be a non-empty array" }, origin);
-      }
-      batch = createBatch(body.prompts);
-      pending = { res, timer: setTimeout(() => { timeout(batch); finish(); }, timeoutMs) };
+      if (body._tooLarge) return tooLarge(req, res, allowOrigin);
+      if (body._parseError) return json(res, 400, { error: "invalid JSON" }, allowOrigin);
+      const checked = sanitizePrompts(body.prompts);
+      if (checked.error) return json(res, 400, { error: checked.error }, allowOrigin);
+      batch = createBatch(checked.prompts);
+      pending = { res, allowOrigin, timer: setTimeout(() => { timeout(batch); finish(); }, timeoutMs) };
       // A dropped client (Ctrl-C'd CLI) must free the slot immediately, not wedge
       // every new request behind 409-busy until timeoutMs. Drop `pending` first so
       // finish() never writes to the dead socket. (This also fires after a normal
@@ -71,10 +232,10 @@ export function createPickServer({ port = 4518, timeoutMs = 120000 } = {}) {
       sse("prompt", view(batch));
       return; // held open until finish()
     }
-    if (req.method === "GET" && url === "/events") {
+    if (req.method === "GET" && path === "/events") {
       res.writeHead(200, {
         "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive",
-        "access-control-allow-origin": origin || "*",
+        ...corsHeaders(allowOrigin),
       });
       res.write(": connected\n\n"); // SSE comment — flushes headers, makes fetch() resolve
       sseClients.add(res);
@@ -82,25 +243,32 @@ export function createPickServer({ port = 4518, timeoutMs = 120000 } = {}) {
       req.on("close", () => sseClients.delete(res));
       return;
     }
-    if (req.method === "POST" && url === "/resolve") {
+    if (req.method === "POST" && path === "/resolve") {
       const body = await readBody(req);
-      if (body._parseError) return json(res, 400, { error: "invalid JSON" }, origin);
+      if (body._tooLarge) return tooLarge(req, res, allowOrigin);
+      if (body._parseError) return json(res, 400, { error: "invalid JSON" }, allowOrigin);
       const { id, index, selection } = body;
+      if (typeof id !== "string" || !Number.isInteger(index) || index < 0) {
+        return json(res, 400, { error: "id must be a string and index a non-negative integer" }, allowOrigin);
+      }
+      const checked = sanitizeSelection(selection);
+      if (checked.error) return json(res, 400, { error: checked.error }, allowOrigin);
       if (batch && id === batch.id) {
-        resolve(batch, index, selection);
+        resolve(batch, index, checked.selection);
         if (view(batch).status === "collecting") sse("prompt", view(batch));
         else finish();
       }
-      return json(res, 200, { ok: true }, origin);
+      return json(res, 200, { ok: true }, allowOrigin);
     }
-    if (req.method === "POST" && url === "/cancel") {
+    if (req.method === "POST" && path === "/cancel") {
       const body = await readBody(req);
-      if (body._parseError) return json(res, 400, { error: "invalid JSON" }, origin);
+      if (body._tooLarge) return tooLarge(req, res, allowOrigin);
+      if (body._parseError) return json(res, 400, { error: "invalid JSON" }, allowOrigin);
       const { id } = body;
       if (batch && id === batch.id) { cancel(batch); finish(); }
-      return json(res, 200, { ok: true }, origin);
+      return json(res, 200, { ok: true }, allowOrigin);
     }
-    return json(res, 404, { error: "not found" }, origin);
+    return json(res, 404, { error: "not found" }, allowOrigin);
   });
 
   server.on("connection", (socket) => {
@@ -109,7 +277,8 @@ export function createPickServer({ port = 4518, timeoutMs = 120000 } = {}) {
   });
 
   return {
-    start: () => new Promise((res_) => server.listen(port, "127.0.0.1", () => res_({ port: server.address().port }))),
+    token,
+    start: () => new Promise((res_) => server.listen(port, PICK_SERVER_DEFAULT_HOST, () => res_({ port: server.address().port }))),
     stop: () => new Promise((res_) => {
       // If a batch is active, cancel it and resolve the held /request cleanly
       // so any awaiting requestPicks() gets a result instead of a socket hang-up.
@@ -124,15 +293,31 @@ export function createPickServer({ port = 4518, timeoutMs = 120000 } = {}) {
 
 // CLI client: POST the prompts and await the held response (blocks until the batch
 // reaches a terminal status server-side). Fails fast with a hint if nothing answers.
-export function requestPicks({ port = 4518, host = "127.0.0.1", prompts }) {
+export function requestPicks({
+  port = PICK_SERVER_DEFAULT_PORT, host = PICK_SERVER_DEFAULT_HOST, prompts, token,
+}) {
   return new Promise((resolve_, reject) => {
     const payload = JSON.stringify({ prompts });
     const req = httpRequest(
-      { host, port, path: "/request", method: "POST", headers: { "content-type": "application/json", "content-length": Buffer.byteLength(payload) } },
+      {
+        host,
+        port,
+        path: "/request",
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "content-length": Buffer.byteLength(payload),
+          ...(token ? { "x-pick-token": token } : {}),
+        },
+      },
       (res) => {
         let b = "";
         res.on("data", (c) => (b += c));
         res.on("end", () => {
+          if (res.statusCode === 401) {
+            reject(new Error(`pick-server on ${host}:${port} rejected the token (start it with \`partforge pick-serve\`, or pass --token)`));
+            return;
+          }
           try {
             resolve_(JSON.parse(b));
           } catch {
@@ -147,9 +332,12 @@ export function requestPicks({ port = 4518, host = "127.0.0.1", prompts }) {
 }
 
 // Human-readable CLI output: one summary line per pick, then the raw JSON to parse.
+// Every string here originated in the browser, so it is sanitised again on the way
+// out — the server already stripped control characters, but this print is the last
+// gate before text lands in an agent's context.
 export function formatPickResult({ status, picks }) {
   const safePicks = Array.isArray(picks) ? picks : [];
-  const lines = [`status: ${status} (${safePicks.length} pick${safePicks.length === 1 ? "" : "s"})`];
+  const lines = [`status: ${sanitizeText(status, 40)} (${safePicks.length} pick${safePicks.length === 1 ? "" : "s"})`];
   for (const { prompt, selection } of safePicks) {
     let summary;
     try {
@@ -161,7 +349,7 @@ export function formatPickResult({ status, picks }) {
     } catch {
       summary = JSON.stringify(selection);
     }
-    lines.push(`• "${prompt}" → ${summary}`);
+    lines.push(`• "${sanitizeText(prompt, MAX_PROMPT_CHARS)}" → ${sanitizeText(summary, MAX_SELECTION_CHARS)}`);
   }
   lines.push("", JSON.stringify({ status, picks }, null, 2));
   return lines.join("\n");

package/src/framework/pick-request/token-store.js

@@ -0,0 +1,31 @@
+// Where `partforge pick-serve` leaves the session token so that `partforge pick`,
+// which runs in a *different* process, can authenticate without the agent copying it
+// by hand. Node-only — never imported by the browser client.
+//
+// The file is the token's only at-rest home: 0600 inside a 0700 directory under the
+// user's home, not a world-readable temp dir, and removed when the server stops.
+import { mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const dir = () => join(homedir(), ".partforge");
+export const pickTokenPath = (port) => join(dir(), `pick-${port}.token`);
+
+export function savePickToken(port, token) {
+  mkdirSync(dir(), { recursive: true, mode: 0o700 });
+  writeFileSync(pickTokenPath(port), token, { mode: 0o600 });
+  return pickTokenPath(port);
+}
+
+export function loadPickToken(port) {
+  try {
+    const t = readFileSync(pickTokenPath(port), "utf8").trim();
+    return t || null;
+  } catch {
+    return null;
+  }
+}
+
+export function clearPickToken(port) {
+  try { rmSync(pickTokenPath(port)); } catch { /* already gone — nothing to clean */ }
+}