fix: harden execution boundaries and preserve async client state

[devswha]

What this changes

Fix data-loss and authorization defects found in an adversarial review, and preserve client state across failed sends, navigation and reconnects. Changes are separated by concern into commits.

• Reject untrusted DNS Host headers before HTTP/WebSocket access and apply API_KEY to upgrades. Harden uploads, symlink reads, approval types, grant revocation and terminal socket ownership.
• Publish clones from private staging so one failed operation cannot delete another checkout. Fence native job mutations to the current run, reject Git option injection and preserve ignored worktree files.
• Preserve drafts, image state, permission requests and queue ownership across async failures. Keep unresolved steering out of automatic resend, resume rejected background queues and release browser frame resources.
• Avoid the pinned SDK's composite workflow-ID trigger and reconstruct explicit skill requests from transcript metadata without exposing expanded instructions.
• Improve real E2Es and isolate release-smoke storage from the caller's database and CLI shim.

Deployment change: DNS-based reverse proxies and tailnet names must set ALLOWED_HOSTS explicitly. Loopback and literal IP access remain supported; ALLOWED_HOSTS=* opts out. The migration is documented in docs/SELF-HOST.md, .env.example and the Nginx template.

Why

Reproductions included unauthorized WebSocket access, matching attacker Host/Origin requests, an upload served as HTML, cross-request clone deletion, stale run/event mutation, non-boolean permission approval and the actual AppContent wrapper losing failed sends. Independent review found three additional composition/cleanup regressions; all were fixed and re-reviewed.

Nine skills were invoked through the real app using only Astra xhigh. They are not all successful workflows:

• deep-interview: five answers persisted and specification saved pending approval.
• no-english: requested Korean output preserved code identifiers and commands.
• insane-search / extragoal: expected rejection of private-target / invalid-branch-and-model-family prerequisites.
• gpt-image / insane-review: blocked by the Astra-only constraint and required external lane/environment.
• ultragoal: requested file and tests passed; mandatory review/goal completion remained blocked.
• autoresearch: verified numeric result and verdict persisted; goal completion/cleanup remained blocked.

Real-SDK offline tests prove delegated children can bypass the parent's denied Bash permission and app allowlist. task, subagent and goal mode remain disabled; no unsafe enabling or alternate model was used to manufacture success. Issues #3/#18 and draft #30 are discussed in the report, without claiming the upstream SDK is fixed.

Detailed findings, test scenarios, outcomes and limitations: docs/plans/adversarial-skills-e2e-2026-09-05.md.

Verification

• npm run verify — passed on macOS: audit, licenses/notices, TypeScript, native checks, Node/Bun tests, lint, identity, production builds.
• Existing E2E lanes — 34 passed, zero failed/skipped: GJC wire/driver (8), actual Chromium/harness (3), clone unit/real Git E2E (14), native services (9).
• Rust core — 61 tests; Tauri — 13 tests; formatting and Clippy with warnings denied passed.
• Credentialed live SDK response/abort smoke — passed with isolated Astra/xhigh configuration.
• Fresh macOS payload + Tauri app built; out-of-tree packaged server and two-boot data-survival smokes passed. Packaging preserved a supplied database canary; no model credentials were available to package smokes.
• Final real browser — offline Send kept the draft and added no unsent message; reconnect did not dispatch it. Skill history/export restored the original request without expanded skill instructions.
• Independent final review — all identified blockers resolved.
• Linux Node 22/24 CI passed on final head 905f4c5 (run 33970941330); standalone website tests/build also passed. Windows execution and a Linux release tarball build were not run locally; no release/notarization was performed.

---

• I am the project owner.
• npm run verify passes.