[wikithoughts]

What changed

Follow-up to #39, from the independent review of #37/#39 (overnight run run-20261011-overnight, task W6-passiveworkers-3739fu).

• passiveworkers/serve.py (middleware):
  • Exact-origin check. When an Origin header is present, it must equal the desk's own origin: scheme, host and port, taken from request.url.scheme + Host, with default ports 80/443 filled in. Previously only the hostname was compared, so a page on http://localhost:3000 (any other local dev server) could POST /research and /cancel/{id}.
  • Strict Host. Host must be exactly host[:port] (a name, or a bracketed IPv6 address). Userinfo (evil@localhost), paths, spaces, localhost: and localhost:80:80 are refused. An absent Host was already 403 and is now pinned by a test.
  • PW_SERVE_ALLOWED_HOSTS: a comma list of extra hostnames or IPs for LAN or Tailscale use. Entries are lowercased, and junk or wildcard entries (*, 0.0.0.0, bad@x) are ignored. The default is unchanged: loopback names plus PW_SERVE_HOST.
• README.md: one line documenting the override, with the note that a TLS proxy must pass Host and X-Forwarded-Proto through.
• passiveworkers/judge.py (compile_report country label only). The country comes from a node's payload, so it is untrusted. It now sits inside the spotlight, as a first line Country: … that is stripped of invisibles, collapsed to one line and capped at 40 characters. The block header is now --- Contribution N ---. The first commit only one-lined the label; the adversarial pass showed that still let about 40 characters of node text sit outside the delimiters, so commit 2 moves it inside.
• Tests:
  • tests/test_serve.py:
    • a different port, a different scheme, a trailing slash, userinfo or no scheme in the Origin;
    • same-origin passes, including IPv6, an implicit :80 and a Docker -p 9000:8770 remap;
    • a userinfo or junk Host;
    • an absent Host, using a raw ASGI scope with no headers;
    • the override: it admits listed names and refuses unlisted names, cross-origin requests between two allowed names, and the default once unset.
  • tests/test_judge_spotlight.py: the country label is inside the spotlight.
  • One existing expectation changed. Origin: http://localhost:8770 against Host: 127.0.0.1:8770 is now 403, because it is a different origin; no real browser on the desk sends that pair.

Findings addressed (claude-review-pw-37-39.md, PR #39 section)

• Addressed: 1 (port ignored), 2 (userinfo Host), 3 (no override), 5 (country label outside the spotlight), and 7 (test gaps: a different-port Origin, a userinfo Host, an absent Host).
• Not changed: 4 (an absent Origin on POST still passes, by design, for non-browser clients) and 6 (indentation flattening in judge blocks).

Verification

• ruff check . && pytest tests/ -q --cov=passiveworkers --cov-fail-under=75 → exit 0: All checks passed!, 704 passed, 9 skipped, total coverage 80.36%. This was the declared gate, run at head c837677 in a .[dev] venv.

• python -m py_compile $(git ls-files '*.py') → exit 0. bash scripts/check_app_js.sh && node scripts/fe_test.js → exit 0, ALL FRONT-END FLOW CHECKS PASSED.

• The new tests fail on the old code. Restoring serve.py and judge.py to origin/main makes 17 tests fail:

  • 8 Origin cases;
  • 6 userinfo/junk Host cases;
  • the override test;
  • the judge country test;
  • the changed localhost-vs-127.0.0.1 expectation.

  The absent-Host and same-origin tests pass on both versions; they pin existing behaviour.

• Live check over a real socket. I ran python -m passiveworkers.serve on 127.0.0.1:18771, with PW_HOME and PW_REPORTS_DIR set to a scratch directory and PW_SERVE_ALLOWED_HOSTS=desk.tailnet.example, then sent requests with curl:

  request	status
  /reports on 127.0.0.1 or localhost	200
  Host: evil.example	403
  Host: evil@localhost:18771	403
  Host: desk.tailnet.example:18771	200
  POST /research with Origin: http://localhost:3000	403
  POST /cancel/nope with the same-origin Origin	404 (reached the route)
  POST /cancel/nope with Origin: http://localhost:3000	403
  Origin: null	403

• Browser. Headless Chrome via chrome-devtools, at http://127.0.0.1:18771/:

  • The desk rendered: brief box, depth, analysts and sources controls, and the "Past reports" list.
  • Clicking the seeded report rendered "Sample report / Hello from the live check."
  • A same-origin fetch('/cancel/nope', {method:'POST'}) from the page, which sends an Origin header, returned 404 from the route, not 403. The page's own POSTs still pass the new check.
  • The only console errors were 404s for the favicon and my deliberate /nope probes.

  This check ran on commit 1. Commit 2 does not touch serve.py.

• An adversarial review pass ran on commit 1 (read-only subagent). It found no Host or Origin bypass across these probes:

  • trailing dots, leading-zero ports, IPv4-mapped and long-form IPv6, decimal IPs and percent-encoding;
  • duplicate-looking or comma-joined Host values;
  • Origin variants: null, uppercase scheme, a trailing slash, userinfo, a trailing space.

  Its label finding is fixed in commit 2.

Not verified / follow-ups

• Follow-up, not in this PR (outside the "country label only" ownership): judge.compile_report still writes the raw node country/model into the final report byline and the ### {country} — {model} headings (judge.py, about lines 418-436). A node could forge a markdown heading in the report. This is not a prompt-injection path, but it needs a one-line sanitize in a separate PR.
• PW_SERVE_ALLOWED_HOSTS accepts harmless junk names (., -) that match the name regex. No browser sends such a Host.
• TLS reverse-proxy flows (X-Forwarded-Proto) are documented but not tested.
• CI was not polled, per the run rules.

🤖 Generated with Claude Code