Raised in review of #1787 (Devin, packages/cloud/src/attach.ts ~L594). Fleet node attach opens the terminal_url returned by Relaycast's terminal-session response (and its replacement-session response) without checking that its origin matches the trusted Relaycast origin. The session request itself goes over the validated HTTPS origin with the workspace key, so the URL is only as trustworthy as that response. Still, a compromised or misrouted response could send the terminal ticket and keystrokes elsewhere.
This behaviour predates #1787: the code moved from packages/cli/src/cli/lib/attach-fleet-node.ts unchanged. Hardening should:
- confirm which hosts Relaycast actually serves terminal WebSockets from (canonical, Agent37 and DEV);
- allow-list those hosts, mapping
wss to the matching https origin;
- reject anything else before connecting;
- update the attach tests, which currently use
ws://127.0.0.1 terminal URLs.
🤖 Generated with Claude Code
Raised in review of #1787 (Devin,
packages/cloud/src/attach.ts~L594). Fleet node attach opens theterminal_urlreturned by Relaycast's terminal-session response (and its replacement-session response) without checking that its origin matches the trusted Relaycast origin. The session request itself goes over the validated HTTPS origin with the workspace key, so the URL is only as trustworthy as that response. Still, a compromised or misrouted response could send the terminal ticket and keystrokes elsewhere.This behaviour predates #1787: the code moved from
packages/cli/src/cli/lib/attach-fleet-node.tsunchanged. Hardening should:wssto the matchinghttpsorigin;ws://127.0.0.1terminal URLs.🤖 Generated with Claude Code