security(dashboard): gate /api/* on loopback Host + same-origin write (closes 3 criticals in #184)

[aaronjmars]

Summary

Closes the three Critical findings from #184 (AntFleet two-model review):

ID	Route	Finding
C1	dashboard/app/api/skills/[name]/run/route.ts	Unauthenticated POST triggers gh workflow run aeon.yml
C2	dashboard/app/api/secrets/route.ts (GET)	Unauthenticated read of secret name set
C3	dashboard/app/api/secrets/route.ts (POST / DELETE)	Unauthenticated set / delete of any GitHub secret on the repo

Single root cause: every dashboard /api/* route assumes "the OS user owns localhost", and we never validated that. Two paths break the assumption today — a malicious page DNS-rebinding attacker.example to 127.0.0.1, and a browser no-cors POST from any origin to http://localhost:5555/api/.... Both reach the routes; both write GitHub secrets or trigger Actions on the operator's behalf.

Fix

One new middleware that gates every /api/* request:

• dashboard/middleware.ts — Next middleware mounted on /api/:path*
• dashboard/lib/security/api-gate.ts — pure validator (no deps)
• dashboard/lib/security/api-gate.test.ts — node:test smoke tests covering stripPort, the env-driven wrapper, the loopback-accept path, both rejection paths, and both env hatches

Two checks:

1. Host header must resolve to a loopback variant (127.0.0.1, localhost, ::1, [::1], 0.0.0.0). Defeats DNS rebinding — the browser sends the dialed hostname (attacker.example), we reject it.
2. On non-GET/HEAD/OPTIONS, Origin (with Referer fallback) must resolve to the same loopback set. Defeats no-cors CSRF — a mode: "no-cors" POST from a malicious page would carry that page's origin in the header.

Two operator hatches preserve LAN / Tailscale / reverse-proxy setups:

Env var	Behaviour
AEON_DASHBOARD_ALLOWED_HOSTS=aeon.local,box.tail-xxx.ts.net	Extends the loopback allowlist by one or more hostnames (comma-separated; case- and port-insensitive).
AEON_DASHBOARD_ALLOW_ANY_HOST=1	Disables the gate entirely. Intended only for a trusted reverse proxy that terminates Host upstream. Loudly insecure if set without an authenticating proxy in front.

What this PR does not touch

This is the surface fix. AntFleet's report flagged a related H5 in dashboard/app/api/auth/route.ts:81-108 — the claude setup-token reassembly loop can splice non-token text into CLAUDE_CODE_OAUTH_TOKEN if the CLI's output contains a hyphen-only continuation line. It's a real bug worth fixing but is orthogonal to the auth-gate work in this PR, so I'd suggest a follow-up. Happy to send.

Also unfixed here: the dashboard launcher (./aeon) currently runs npm run dev -- -p $PORT which lets Next bind to 0.0.0.0. The middleware makes this safe by rejecting non-loopback Hosts, but pinning --hostname 127.0.0.1 in the launcher would add defense in depth. Worth a tiny follow-up.

Backward compatibility

Pure addition. The default loopback set covers every "just run ./aeon" launch path. Existing operators see no change. Anyone running the dashboard behind a non-loopback hostname today must set one of the two env vars — there's no silent break, the rejection includes a clear hint explaining the env knobs.

Test plan

• node --test dashboard/lib/security/api-gate.test.ts runs the smoke tests (stdlib-only, no test runner dep added)
• tsc --noEmit clean (will be exercised by Next's build)
• Manual: ./aeon → confirm curl -H 'Host: attacker.example' http://127.0.0.1:5555/api/secrets returns 403 with {"error":"Host not allowed",...}
• Manual: ./aeon → confirm curl -H 'Origin: http://attacker.example' -X POST http://127.0.0.1:5555/api/skills/morning-brief/run returns 403 with {"error":"Cross-origin write rejected",...}
• Manual: ./aeon → confirm normal in-browser dashboard usage still works

Closes / refs

• Closes the 3 critical findings in AntFleet two-model review surfaced 12 findings on recent merged PRs #184
• Receipts:
  • C1: fix(dashboard/skills/run): use execFileSync to harden against shell injection (replay of 89d566b) AntFleet/aeon-template#1 (comment)
  • C2: fix(dashboard/secrets): use execFileSync to close shell-injection on secret set/delete (replay of 6c07691) AntFleet/aeon-template#3 (comment)
  • C3: fix(dashboard): pass -R repo to gh commands so multi-remote setups work (replay of 416244f) AntFleet/aeon-template#25 (comment)

🤖 Generated with Claude Code