Enforce request authentication on the Tower local API - #1421

Open

amrmelsayed wants to merge 40 commits into

mainfrom

builder/task-NHnJ

Commits on Aug 12, 2026

chore(porch): builder-task-nhnj init pir
amrmelsayed
committed
0cc35cc
[PIR] Plan draft: enforce request authentication on the Tower API
amrmelsayed
committed
aabb5bc
chore(porch): secfix-1 init pir
amrmelsayed
committed
e1a6c9b
[PIR] Rename plan to porch-native id secfix-1
amrmelsayed
committed
2d71312
chore(porch): secfix-1 plan-approval gate-requested
amrmelsayed
committed
1e53baa
chore(porch): secfix-1 plan-approval gate-approved
amrmelsayed
committed
5f10f72
chore(porch): secfix-1 implement phase-transition
amrmelsayed
committed
edab49d
[PIR] types: add request-authentication wire contracts
amrmelsayed
committed
e618126
[PIR] server: enforce request authentication on the Tower API
amrmelsayed
committed
37814ee
[PIR] clients: transport the shared key on HTTP and WebSocket
amrmelsayed
committed
3a882b3
[PIR] tests: request-authentication enforcement
amrmelsayed
committed
b0d711f
[PIR] thread: implement-phase progress + results
amrmelsayed
committed
0c64c19
[PIR] types: centralize the terminal WS subprotocol builder
amrmelsayed
committed
40a0809
[PIR] server: same-origin key delivery, Host guard, CORS shell isolation
amrmelsayed
committed
5f4cef9
[PIR] clients: web dashboard + annotator key transport
amrmelsayed
committed
f98f42e
[PIR] tests: Host guard + annotator allowlist coverage
amrmelsayed
committed
9761070
[PIR] thread: iteration-2 (cmap findings) progress
amrmelsayed
committed
4f29b24
[PIR] server: bridge/tunnel Host handling, injection safety, diagnostics
amrmelsayed
committed
19ae501
[PIR] vscode: authenticate the SSE client
amrmelsayed
committed
c7ebde9
[PIR] annotator: vendor three.js locally; template hardening
amrmelsayed
committed
0220b46
[PIR] tests: bridge Host, no-slash workspace, SSE-stream + mock updates
amrmelsayed
committed
34f259a
[PIR] harden: narrow bridge Host to IP-literals; encode annotator XSS sinks
amrmelsayed
committed
32dc434
[PIR] thread: iteration-4 + reaching dev-approval
amrmelsayed
committed
aa2a718
chore(porch): secfix-1 dev-approval gate-requested
amrmelsayed
committed
2bc7512
[PIR] fix: make @cluesmith/codev-types a runtime dependency of codev
amrmelsayed
committed
f0f4afe
[PIR] thread: boot-regression root cause + dependency fix
amrmelsayed
committed
dad963a
[PIR] fix(local-install): pack + install @cluesmith/codev-types
amrmelsayed
committed
e8795de
[PIR] fix: authenticate the Tower startup readiness probe
amrmelsayed
committed
0ff32b6
[PIR] rename the auth header codev-web-key -> codev-tower-key (dual-accept)
amrmelsayed
committed
11978b5
[PIR] thread: readiness-probe fix + auth header rename
amrmelsayed
committed
aa2d6c9
[PIR] chore(vscode): satisfy eslint curly rule in tunnel.ts
amrmelsayed
committed
f36a134
chore(porch): secfix-1 dev-approval gate-approved
amrmelsayed
committed
2466756
chore(porch): secfix-1 review phase-transition
amrmelsayed
committed
03a5705
[PIR] Review + retrospective: Tower request-authentication hardening
amrmelsayed
committed
3892bd6
chore(porch): secfix-1 record PR #1421
amrmelsayed
committed
434b0a4
chore(porch): secfix-1 review build-complete
amrmelsayed
committed
6b631b2
[PIR] review: address 3-way consult (docs + WS echo/vscode tests)
amrmelsayed
committed
d67c419
chore(porch): secfix-1 pr gate-requested
amrmelsayed
committed
c37312c
[PIR] fix(ci): pack + install codev-types; authenticate Tower e2e suites
amrmelsayed
committed
acb8285
[PIR] refactor(3d-viewer): vendor three.js at build time, not in git
amrmelsayed
committed
9b35ac1