praxis-sec 1.2.0 → 1.2.2

package/cli/core/output/html-theme.js

@@ -1,158 +1,158 @@
-/**
- * Shared HTML report theme — single source of truth for every Praxis HTML surface.
- * ============================================================================
- *
- * Extracted (P-IMP-051c) because `cli/agents/html-reporter.js` and
- * `cli/commands/team-report.js` each carried their own ~100-line inline stylesheet
- * and their own severity palette. Those palettes had already drifted
- * (`critical` was `#ef4444` in one and `#dc2626` in the other), so every brand or
- * styling fix had to be applied twice — and the two files disagreed on the same
- * concept.
- *
- * Also centralises the primitives that must never be re-implemented per report:
- *   - `esc()`               — HTML escaping. `team-report.js` previously had none and
- *                             interpolated finding text straight into markup, which is
- *                             an injection sink in a file users open in a browser.
- *   - `severityBadgeClass()` — maps a severity to a *known* CSS class, so an arbitrary
- *                             severity string can't be injected into a class attribute.
- *   - `countBySeverity()`    — one counting implementation, not one per report.
- *
- * Design constraints (per AGENTS.md): no build step, no bundler, no framework. These
- * are plain template strings and functions, so every report stays a single
- * self-contained offline HTML file.
- */
-
-/** Severity → accent colour. Used for bars, legends, and inline accents. */
-export const SEVERITY_COLORS = {
-  critical: '#ef4444',
-  high: '#f97316',
-  medium: '#eab308',
-  low: '#38bdf8',
-  info: '#64748b',
-};
-
-/** Security-score letter grade → colour. */
-export const GRADE_COLORS = {
-  A: '#22c55e',
-  B: '#06b6d4',
-  C: '#eab308',
-  D: '#f97316',
-  F: '#ef4444',
-};
-
-/** Every severity we recognise, in report order. */
-export const SEVERITIES = ['critical', 'high', 'medium', 'low'];
-
-/**
- * Severities rendered in distribution bars/legends. Includes `info` so the segments
- * always sum to 100% of the findings shown — omitting it left the bar visibly
- * under-filled whenever a scan produced informational findings.
- */
-export const DISPLAY_SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
-
-/**
- * Escapes text for interpolation into HTML markup or a quoted attribute.
- * Null/undefined become an empty string so callers can interpolate directly.
- */
-export function esc(str) {
-  if (str === null || str === undefined) return '';
-  return String(str)
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#039;');
-}
-
-/**
- * Maps a severity to a known-safe CSS class suffix.
- *
- * Returns `''` for anything unrecognised so the result is always a safe subset of
- * the class attribute — a finding whose `severity` came from a parsed report file
- * must never be able to break out of `class="sev-badge …"`.
- */
-export function severityBadgeClass(severity) {
-  const key = String(severity || '').toLowerCase();
-  return SEVERITIES.includes(key) || key === 'info' ? key : '';
-}
-
-/** Renders a severity badge span. Escapes the label and sanitises the class. */
-export function severityBadge(severity, label) {
-  const cls = severityBadgeClass(severity);
-  const text = label ?? String(severity || 'unknown');
-  const classes = cls ? `sev-badge sev-${cls}` : 'sev-badge';
-  return `<span class="${classes}">${esc(text)}</span>`;
-}
-
-/** Counts findings per severity, always returning a fully-populated record. */
-export function countBySeverity(findings = []) {
-  const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
-  for (const f of Array.isArray(findings) ? findings : []) {
-    const key = String(f?.severity || '').toLowerCase();
-    if (key in counts) counts[key]++;
-  }
-  return counts;
-}
-
-/**
- * The shared base stylesheet: reset, typography, layout container, tables, code,
- * severity badges, and the muted/empty/footer primitives. Every report includes
- * this, then appends its own component styles.
- */
-export function baseStyles() {
-  return `
-      *{margin:0;padding:0;box-sizing:border-box}
-      html{scroll-behavior:smooth}
-      body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;background:#090d16;color:#cbd5e1;line-height:1.55;font-size:14px}
-      a{color:#38bdf8;text-decoration:none}
-      a:hover{text-decoration:underline}
-
-      .container{max-width:1440px;margin:1.8rem auto;padding:0 2rem}
-      h1{font-size:1.8rem;font-weight:700;color:#f8fafc;margin-bottom:0.25rem}
-      h2{font-size:1.1rem;font-weight:600;margin:2rem 0 1rem;color:#94a3b8;border-bottom:1px solid #1e293b;padding-bottom:0.5rem;text-transform:uppercase;letter-spacing:0.05em}
-
-      .table-responsive{overflow-x:auto}
-      table{width:100%;border-collapse:collapse;font-size:0.86rem;text-align:left}
-      th{background:#131d33;color:#94a3b8;padding:0.75rem 1rem;font-size:0.75rem;text-transform:uppercase;letter-spacing:0.6px;border-bottom:1px solid #1e293b}
-      td{padding:0.75rem 1rem;border-bottom:1px solid #172239;vertical-align:top}
-      tr:hover td{background:#111b30}
-      code{background:#050811;border:1px solid #1e293b;color:#7dd3fc;padding:2px 6px;border-radius:4px;font-size:0.8rem;word-break:break-word}
-      small{color:#64748b}
-
-      .sev-badge{display:inline-block;padding:3px 9px;border-radius:6px;font-size:0.72rem;font-weight:800;text-transform:uppercase;letter-spacing:0.5px}
-      .sev-critical{background:#450a0a;color:#fca5a5;border:1px solid #991b1b}
-      .sev-high{background:#431407;color:#fdba74;border:1px solid #9a3412}
-      .sev-medium{background:#422006;color:#fde047;border:1px solid #854d0e}
-      .sev-low{background:#082f49;color:#7dd3fc;border:1px solid #075985}
-      .sev-info{background:#1e293b;color:#cbd5e1;border:1px solid #334155}
-
-      .muted{color:#64748b}
-      .ok{color:#6ee7b7}
-      .fail{color:#fca5a5}
-      .empty-state{text-align:center;color:#64748b;padding:2.5rem 1rem;font-size:0.9rem}
-      .footer{text-align:center;padding:2.5rem 0 1.5rem;color:#64748b;font-size:0.8rem;border-top:1px solid #1e293b;margin-top:3rem}
-      @media(max-width:1024px){.container{padding:0 1rem}}
-    `;
-}
-
-/**
- * Wraps body markup in a complete, self-contained HTML document.
- *
- * `styles` is injected verbatim and must be trusted (it is always generated by
- * this module, never derived from scan findings). `body` and `title` are escaped.
- */
-export function documentShell({ title, styles, body, bodyClass = '' }) {
-  const cls = bodyClass ? ` class="${esc(bodyClass)}"` : '';
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<title>${esc(title)}</title>
-<style>${styles}</style>
-</head>
-<body${cls}>
-${body}
-</body>
-</html>`;
-}
+/**
+ * Shared HTML report theme — single source of truth for every Praxis HTML surface.
+ * ============================================================================
+ *
+ * Extracted because `cli/agents/html-reporter.js` and
+ * `cli/commands/team-report.js` each carried their own ~100-line inline stylesheet
+ * and their own severity palette. Those palettes had already drifted
+ * (`critical` was `#ef4444` in one and `#dc2626` in the other), so every brand or
+ * styling fix had to be applied twice — and the two files disagreed on the same
+ * concept.
+ *
+ * Also centralises the primitives that must never be re-implemented per report:
+ *   - `esc()`               — HTML escaping. `team-report.js` previously had none and
+ *                             interpolated finding text straight into markup, which is
+ *                             an injection sink in a file users open in a browser.
+ *   - `severityBadgeClass()` — maps a severity to a *known* CSS class, so an arbitrary
+ *                             severity string can't be injected into a class attribute.
+ *   - `countBySeverity()`    — one counting implementation, not one per report.
+ *
+ * Design constraints (per AGENTS.md): no build step, no bundler, no framework. These
+ * are plain template strings and functions, so every report stays a single
+ * self-contained offline HTML file.
+ */
+
+/** Severity → accent colour. Used for bars, legends, and inline accents. */
+export const SEVERITY_COLORS = {
+  critical: '#ef4444',
+  high: '#f97316',
+  medium: '#eab308',
+  low: '#38bdf8',
+  info: '#64748b',
+};
+
+/** Security-score letter grade → colour. */
+export const GRADE_COLORS = {
+  A: '#22c55e',
+  B: '#06b6d4',
+  C: '#eab308',
+  D: '#f97316',
+  F: '#ef4444',
+};
+
+/** Every severity we recognise, in report order. */
+export const SEVERITIES = ['critical', 'high', 'medium', 'low'];
+
+/**
+ * Severities rendered in distribution bars/legends. Includes `info` so the segments
+ * always sum to 100% of the findings shown — omitting it left the bar visibly
+ * under-filled whenever a scan produced informational findings.
+ */
+export const DISPLAY_SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+
+/**
+ * Escapes text for interpolation into HTML markup or a quoted attribute.
+ * Null/undefined become an empty string so callers can interpolate directly.
+ */
+export function esc(str) {
+  if (str === null || str === undefined) return '';
+  return String(str)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
+/**
+ * Maps a severity to a known-safe CSS class suffix.
+ *
+ * Returns `''` for anything unrecognised so the result is always a safe subset of
+ * the class attribute — a finding whose `severity` came from a parsed report file
+ * must never be able to break out of `class="sev-badge …"`.
+ */
+export function severityBadgeClass(severity) {
+  const key = String(severity || '').toLowerCase();
+  return SEVERITIES.includes(key) || key === 'info' ? key : '';
+}
+
+/** Renders a severity badge span. Escapes the label and sanitises the class. */
+export function severityBadge(severity, label) {
+  const cls = severityBadgeClass(severity);
+  const text = label ?? String(severity || 'unknown');
+  const classes = cls ? `sev-badge sev-${cls}` : 'sev-badge';
+  return `<span class="${classes}">${esc(text)}</span>`;
+}
+
+/** Counts findings per severity, always returning a fully-populated record. */
+export function countBySeverity(findings = []) {
+  const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+  for (const f of Array.isArray(findings) ? findings : []) {
+    const key = String(f?.severity || '').toLowerCase();
+    if (key in counts) counts[key]++;
+  }
+  return counts;
+}
+
+/**
+ * The shared base stylesheet: reset, typography, layout container, tables, code,
+ * severity badges, and the muted/empty/footer primitives. Every report includes
+ * this, then appends its own component styles.
+ */
+export function baseStyles() {
+  return `
+      *{margin:0;padding:0;box-sizing:border-box}
+      html{scroll-behavior:smooth}
+      body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;background:#090d16;color:#cbd5e1;line-height:1.55;font-size:14px}
+      a{color:#38bdf8;text-decoration:none}
+      a:hover{text-decoration:underline}
+
+      .container{max-width:1440px;margin:1.8rem auto;padding:0 2rem}
+      h1{font-size:1.8rem;font-weight:700;color:#f8fafc;margin-bottom:0.25rem}
+      h2{font-size:1.1rem;font-weight:600;margin:2rem 0 1rem;color:#94a3b8;border-bottom:1px solid #1e293b;padding-bottom:0.5rem;text-transform:uppercase;letter-spacing:0.05em}
+
+      .table-responsive{overflow-x:auto}
+      table{width:100%;border-collapse:collapse;font-size:0.86rem;text-align:left}
+      th{background:#131d33;color:#94a3b8;padding:0.75rem 1rem;font-size:0.75rem;text-transform:uppercase;letter-spacing:0.6px;border-bottom:1px solid #1e293b}
+      td{padding:0.75rem 1rem;border-bottom:1px solid #172239;vertical-align:top}
+      tr:hover td{background:#111b30}
+      code{background:#050811;border:1px solid #1e293b;color:#7dd3fc;padding:2px 6px;border-radius:4px;font-size:0.8rem;word-break:break-word}
+      small{color:#64748b}
+
+      .sev-badge{display:inline-block;padding:3px 9px;border-radius:6px;font-size:0.72rem;font-weight:800;text-transform:uppercase;letter-spacing:0.5px}
+      .sev-critical{background:#450a0a;color:#fca5a5;border:1px solid #991b1b}
+      .sev-high{background:#431407;color:#fdba74;border:1px solid #9a3412}
+      .sev-medium{background:#422006;color:#fde047;border:1px solid #854d0e}
+      .sev-low{background:#082f49;color:#7dd3fc;border:1px solid #075985}
+      .sev-info{background:#1e293b;color:#cbd5e1;border:1px solid #334155}
+
+      .muted{color:#64748b}
+      .ok{color:#6ee7b7}
+      .fail{color:#fca5a5}
+      .empty-state{text-align:center;color:#64748b;padding:2.5rem 1rem;font-size:0.9rem}
+      .footer{text-align:center;padding:2.5rem 0 1.5rem;color:#64748b;font-size:0.8rem;border-top:1px solid #1e293b;margin-top:3rem}
+      @media(max-width:1024px){.container{padding:0 1rem}}
+    `;
+}
+
+/**
+ * Wraps body markup in a complete, self-contained HTML document.
+ *
+ * `styles` is injected verbatim and must be trusted (it is always generated by
+ * this module, never derived from scan findings). `body` and `title` are escaped.
+ */
+export function documentShell({ title, styles, body, bodyClass = '' }) {
+  const cls = bodyClass ? ` class="${esc(bodyClass)}"` : '';
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${esc(title)}</title>
+<style>${styles}</style>
+</head>
+<body${cls}>
+${body}
+</body>
+</html>`;
+}

package/cli/core/output/json.js

@@ -1,48 +1,56 @@
-/**
- * JSON output formatter.
- *
- * Reports are emitted with `schemaVersion` so consumers can pin to a
- * version. Bump the version when the shape changes in a breaking way.
- *
- * Scanner hardening: secret-category findings never expose their raw
- * matched value — `matched` is redacted centrally so no consumer of the
- * JSON report can leak a credential.
- */
-
-const SCHEMA_VERSION = 3;
-
-function redactFinding(f) {
-  if (!f || typeof f !== 'object') return f;
-  const isSecret = f.category === 'secrets' || f.category === 'secret'
-    || /secret|api[_-]?key|token|password|credential/i.test(String(f.rule || ''));
-  const out = { ...f };
-  if (f.matched) {
-    out.matched = isSecret
-      ? `${String(f.matched).slice(0, 3)}***`
-      : String(f.matched).slice(0, 160);
-  }
-  if (out.file) {
-    out.file = String(out.file)
-      .replace(/\\/g, '/')
-      .replace(/^[a-zA-Z]:\/+/, '')
-      .replace(/^.*\/Praxis\/showcase-target\//, 'showcase-target/')
-      .replace(/^.*\/Praxis\//, '');
-  }
-  return out;
-}
-
-export default function json(report, options = {}) {
-  const { pretty = true } = options;
-  const enriched = {
-    schemaVersion: SCHEMA_VERSION,
-    ...report,
-  };
-  if (Array.isArray(enriched.findings)) {
-    enriched.findings = enriched.findings.map(redactFinding);
-  }
-  return pretty
-    ? JSON.stringify(enriched, null, 2)
-    : JSON.stringify(enriched);
-}
-
-export { redactFinding, SCHEMA_VERSION };
+/**
+ * JSON output formatter.
+ *
+ * Reports are emitted with `schemaVersion` so consumers can pin to a
+ * version. Bump the version when the shape changes in a breaking way.
+ *
+ * Scanner hardening: secret-category findings never expose their raw
+ * matched value — `matched` is redacted centrally so no consumer of the
+ * JSON report can leak a credential. Finding paths are normalised against the scan
+ * root by the orchestrator, so no consumer can receive an absolute path either.
+ */
+
+import path from 'path';
+
+const SCHEMA_VERSION = 3;
+
+function redactFinding(f) {
+  if (!f || typeof f !== 'object') return f;
+  const isSecret = f.category === 'secrets' || f.category === 'secret'
+    || /secret|api[_-]?key|token|password|credential/i.test(String(f.rule || ''));
+  const out = { ...f };
+  if (f.matched) {
+    out.matched = isSecret
+      ? `${String(f.matched).slice(0, 3)}***`
+      : String(f.matched).slice(0, 160);
+  }
+  if (out.file) {
+    // Paths arrive already normalised against the scan root by the orchestrator,
+    // so this only has to unify separators. The three strippers that used to live
+    // here were wrong for everyone but this repository:
+    //   `^[a-zA-Z]:\/+`  turned `C:\Users\alice\.cursor\mcp.json` into
+    //                   `Users/alice/.cursor/mcp.json` — leaking the username and
+    //                   naming a repo-relative file that does not exist;
+    //   the two `/Praxis/` rules were dogfooding hacks that silently truncated any
+    //                   real path merely containing a directory called `Praxis`.
+    // See cli/core/paths.js for the replacement.
+    out.file = String(out.file).split(path.sep).join('/').replace(/\\/g, '/');
+  }
+  return out;
+}
+
+export default function json(report, options = {}) {
+  const { pretty = true } = options;
+  const enriched = {
+    schemaVersion: SCHEMA_VERSION,
+    ...report,
+  };
+  if (Array.isArray(enriched.findings)) {
+    enriched.findings = enriched.findings.map(redactFinding);
+  }
+  return pretty
+    ? JSON.stringify(enriched, null, 2)
+    : JSON.stringify(enriched);
+}
+
+export { redactFinding, SCHEMA_VERSION };

package/cli/core/output/sarif.js

@@ -1,7 +1,7 @@
 /**
  * SARIF v2.1.0 output formatter.
  *
- * The single SARIF serializer for Praxis (P-IMP-062). Every emitting path must go
+ * The single SARIF serializer for Praxis. Every emitting path must go
  * through here: `scan --sarif`, `scan ci --sarif`, `audit --sarif`, `redteam --sarif`,
  * `scan standard --sarif` and `--format sarif`. Four commands used to carry private
  * copies of this logic, which meant fixes applied here reached almost nobody — most
@@ -84,7 +84,7 @@ function renderSARIFDocument(report, options = {}) {
     toolName = 'praxis',
     // Defaults to the real package version. This used to fall back to a hardcoded
     // '1.0.0', so any caller that forgot to pass `toolVersion` reported a confidently
-    // wrong driver version in Code Scanning (P-IMP-065).
+    // wrong driver version in Code Scanning.
     toolVersion = report.version || toolVersion_(),
     informationUri = 'https://github.com/Ganron007/Praxis',
     rootPath = null,

package/cli/core/paths.js

@@ -0,0 +1,91 @@
+/**
+ * Honest, publishable paths for findings.
+ *
+ * A finding is not always about a file inside the scanned tree.
+ * `MCP_SHADOW_CONFIG` reports the developer's own `~/.cursor/mcp.json`, because a
+ * shadow MCP server configured outside version control is precisely the finding
+ * worth reporting. That file sits above the scan root, and neither obvious way of
+ * rendering it is acceptable:
+ *
+ *   path.relative(root, file)  ->  '../../../Users/alice/.cursor/mcp.json'
+ *                                  leaks the username and the directory depth into
+ *                                  a report that gets pasted into a CI comment.
+ *   strip the drive letter     ->  'Users/alice/.cursor/mcp.json'
+ *                                  does not exist, and falsely reads as
+ *                                  repo-relative, so the finding is unlocatable.
+ *
+ * The only honest rendering of a path above the root is `~/…`. It identifies the
+ * file, leaks neither the username nor the directory layout, and — unlike either
+ * alternative — is identical on every machine, so a self-scan's findings do not
+ * change identity when a colleague runs it.
+ *
+ * Applied once by the orchestrator, before findings reach any renderer, because
+ * the terminal table, the HTML and JSON reports, CI annotations and SARIF all read
+ * the same `finding.file`. `fix` and `remediate` build their own absolute paths and
+ * never read this field, so normalising it cannot redirect a write.
+ */
+
+import os from 'os';
+import path from 'path';
+
+const toSlash = (p) => String(p).split(path.sep).join('/').replace(/\\/g, '/');
+
+// `path.isAbsolute` is platform-specific: on POSIX it reports false for
+// `C:/work/src/a.js`, because that is a legal relative filename there. Findings
+// normally come from the host's own glob, but a path read back from a report or
+// a cache can carry the other platform's shape, and treating it as relative would
+// print a drive letter straight into the output. Same guard sarif.js uses.
+const isAbsoluteLike = (s) => path.isAbsolute(s) || /^[a-zA-Z]:[\\/]/.test(s);
+
+/**
+ * Render a finding's file for display.
+ *
+ * @param {string} file  Absolute or already-relative path.
+ * @param {string} [root] Absolute scan root, when known.
+ * @returns {string} Root-relative when inside `root`, `~/…` when inside the home
+ *   directory, otherwise the bare filename — never an absolute path.
+ */
+export function displayPath(file, root) {
+  if (file === undefined || file === null || file === '') return file;
+
+  const s = String(file);
+  // Already display-shaped. Passing a relative path back through
+  // `path.relative(root, ...)` would resolve it against the cwd, escape the root
+  // and collapse it to a bare filename — the trap that made Code Scanning alerts
+  // unlocatable.
+  if (!isAbsoluteLike(s)) return toSlash(s);
+
+  if (root) {
+    const rel = path.relative(root, s);
+    // `rel` starting with '..' means the file is outside the scan root.
+    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) return toSlash(rel);
+  }
+
+  const home = os.homedir();
+  if (home && s !== home && s.startsWith(home + path.sep)) {
+    return '~/' + toSlash(s.slice(home.length + 1));
+  }
+
+  // Outside the root and outside home: identify the file without publishing the
+  // local directory layout.
+  return path.basename(s);
+}
+
+/**
+ * Apply {@link displayPath} to every finding that carries a path.
+ *
+ * The orchestrator calls this once, at the boundary where findings stop being
+ * internal state and become report output.
+ *
+ * @param {Array<object>} findings Mutated in place and returned.
+ * @param {string} [root] Absolute scan root.
+ */
+export function normalizeFindingPaths(findings, root) {
+  if (!Array.isArray(findings)) return findings;
+  for (const f of findings) {
+    if (f && typeof f === 'object' && f.file) f.file = displayPath(f.file, root);
+  }
+  return findings;
+}
+
+export default displayPath;

package/cli/core/web/jobs.js

@@ -36,7 +36,7 @@ export class JobQueue extends EventEmitter {
    * @returns {{ok:true, job:object} | {ok:false, error:string}}
    */
   enqueue(project) {
-    const queued = this.jobs.length + this.pending.length;
+    const queued = this.running + this.pending.length;
     if (queued >= this.maxQueue) {
       return { ok: false, error: `queue is full (max ${this.maxQueue} scans)` };
     }
@@ -203,4 +203,4 @@ export async function runScanWithOrchestrator(rootPath, onProgress) {
     standardsSummary,
     scannedAt: new Date().toISOString(),
   };
-}
+}

package/cli/core/web/server.js

@@ -18,9 +18,11 @@
 
 import http from 'http';
 import { URL } from 'url';
+import { isIP } from 'net';
 import { listProjects, addProject, getProject, removeProject } from './projects.js';
 import { JobQueue, runScanWithOrchestrator } from './jobs.js';
 import { renderFrontend, AGENT_ROSTER } from './ui.js';
+import jsonReport from '../output/json.js';
 
 const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']); // praxis-ignore SSRF_INTERNAL_IP — loopback allow-list: binding only to loopback IS the mitigation
 const CLIENT_HEADER = 'x-praxis-client';
@@ -28,7 +30,8 @@ const CLIENT_VALUE = 'praxis-web';
 const MAX_BODY_BYTES = 64 * 1024;
 
 export function isLoopback(host) {
-  return LOOPBACK.has(host) || String(host).startsWith('127.');
+  const normalized = String(host).replace(/^\[|\]$/g, '');
+  return LOOPBACK.has(normalized) || (isIP(normalized) === 4 && normalized.startsWith('127.'));
 }
 
 /** Decides the effective bind, refusing an unsafe remote bind (threat T4). */
@@ -136,14 +139,14 @@ function guardMutation(req) {
   }
   const origin = req.headers.origin;
   if (origin) {
-    let host;
+    let originURL;
     try {
-      host = new URL(origin).hostname;
+      originURL = new URL(origin);
     } catch {
       return { ok: false, error: 'malformed Origin' };
     }
-    // Same-origin or loopback origin only: blocks DNS rebinding.
-    if (!isLoopback(host) && host !== 'localhost') {
+    // A different loopback port is still a different browser origin.
+    if (!['http:', 'https:'].includes(originURL.protocol) || originURL.host !== req.headers.host) {
       return { ok: false, error: 'cross-origin request refused' };
     }
   }
@@ -211,6 +214,13 @@ export function createServer({ host: _host = '127.0.0.1', port: _port = 7317, to
     const route = url.pathname.replace(/\/+$/, '') || '/';
     const method = req.method || 'GET';
 
+    // DNS rebinding can read reports through GET as well as mutate through POST.
+    // Without token auth, every request must address the actual local server.
+    if (!token && ((!isLoopback(url.hostname) && url.hostname !== 'localhost') ||
+        Number(url.port || 80) !== server.address()?.port)) {
+      return sendJSON(res, 403, { error: 'untrusted Host header' });
+    }
+
     // Auth for remote binds.
     if (token) {
       const auth = req.headers.authorization || '';
@@ -266,7 +276,7 @@ export function createServer({ host: _host = '127.0.0.1', port: _port = 7317, to
           if (!job) return sendJSON(res, 404, { error: 'no completed scan for this project' });
           const full = jobs.get(job.id);
           if (!full?.result) return sendJSON(res, 404, { error: 'scan has no result' });
-          return sendJSON(res, 200, { job: jobs._public(full), result: full.result });
+          return sendJSON(res, 200, { job: jobs._public(full), result: JSON.parse(jsonReport(full.result)) });
         }
       }
 
@@ -279,7 +289,7 @@ export function createServer({ host: _host = '127.0.0.1', port: _port = 7317, to
         const full = jobs.get(jobReportMatch[1]);
         if (!full) return sendJSON(res, 404, { error: 'unknown job' });
         if (!full.result) return sendJSON(res, 404, { error: 'scan has no result' });
-        return sendJSON(res, 200, { job: jobs._public(full), result: full.result });
+        return sendJSON(res, 200, { job: jobs._public(full), result: JSON.parse(jsonReport(full.result)) });
       }
 
       const jobMatch = route.match(/^\/api\/jobs\/([\w-]+)$/);
@@ -313,6 +323,7 @@ export function createServer({ host: _host = '127.0.0.1', port: _port = 7317, to
         });
         const send = j => res.write(`data: ${JSON.stringify(j)}\n\n`);
         send(jobs._public(job));
+        if (['done', 'failed', 'cancelled'].includes(job.status)) return res.end();
         const onUpdate = j => {
           if (j.id !== job.id) return;
           send(j);
@@ -350,4 +361,4 @@ export function createServer({ host: _host = '127.0.0.1', port: _port = 7317, to
   });
 
   return { server, jobs };
-}
+}