fix(mcode-webui): round 8 — CORS tightening + cross-origin token-leak fix (supersedes #16)

[modacker]

Supersedes #16 — bring marketplace mcode-webui in sync with upstream round 8

The previous PR #16 (564af66, CORS preflight) is now stale: the source-of-truth Wzdhehe/Mcode-webui landed commits ffacf58 (round 3 auth.js setters) + afd4167/0dbdacd/c448424 (rounds 4-6 db.js better-sqlite3 path resolver) + 091dec5 (Token Plan key integration) + 7acdfe9 (round 8 CSRF / bootstrap-token-disclosure fix), all of which are missing from PR #16.

The marketplace copy at plugins/Wzdhehe/mcode-webui/ should match the upstream. This PR brings the marketplace in sync with the upstream state at the round 8 merge commit (Wzdhehe/Mcode-webui#6, merged 2026-09-04 by Wzdhehe at 072220c).

What's in this PR

Cherry-picked from Wzdhehe/Mcode-webui main (7acdfe9):

• server/router.js — new setCorsHeaders(req, res) helper; Access-Control-Allow-Origin: * removed; CORS is now per-origin with MCODE_WEBUI_ALLOWED_ORIGINS env allowlist + same-origin default
• server/lib/auth.js — new isCrossOriginRequest; isRequestAuthorized no longer bypasses Gate 3 for cross-origin requests over loopback
• server/lib/settings.js — getSettingsSnapshot no longer returns currentToken (always empty string, field kept for back-compat)
• server/lib/state-bus.js — all 4 SSE push paths (per-cid / broadcast / online-count / mcodeSessionsFetchedAndPush) emit currentToken: ""; broadcastTokenRotated payload changed from raw token to JSON.stringify({rotated: true, at: <ms>})
• server/routes/settings.js — POST /api/settings {resetToken: true} no longer returns currentToken; only {ok, changed, tokenRotated, hint, tokenRotatedAt}
• references/SECURITY-NOTES.md — §9 row updated + new §10 "Cross-origin request handling" added
• public/app/state.js — auth.token_rotated handler clears HEADERS.Authorization + localStorage and dispatches webui:token_rotated CustomEvent
• public/app/render.js — listens for webui:token_rotated and shows an 8s toast
• public/app/i18n.js — lan_card_token_saved_v2 (zh+en) + token_rotated_toast (zh+en)
• test/router-cors.test.js — L279 "Allow-Origin remains wildcard" replaced with NEGATIVE assertion + setCorsHeaders presence test
• test/routes-settings.test.js — resetToken:true test asserts response does NOT include currentToken
• test/state-bus.test.js — new state-bus — currentToken removal (round 8) describe block (3 tests)
• + BASELINE-2026-09-04.md — pre-fix snapshot
• eslint config path fix (moved from repo root to plugins/Wzdhehe/mcode-webui/eslint.config.mjs)

Threat model (what this closes)

The hetaoBackend 2026-09-01 report against PR #23 head 091dec5 identified a CSRF / bootstrap-token-disclosure vulnerability: a malicious page at https://evil.example could exfiltrate the operator's auth token from a webui instance running on the same machine via fetch('http://127.0.0.1:PORT/api/settings'). Three combined properties created the leak — all three are now closed:

1. ✅ Access-Control-Allow-Origin: * → per-origin with allowlist
2. ✅ isRequestAuthorized bypassed Gate 3 for cross-origin over loopback → now requires valid token
3. ✅ currentToken in HTTP responses + SSE state pushes → removed from all channels

The new value is delivered out-of-band: server stdout + ~/.mcode-webui/settings.json.

Test results

$ npm test
ℹ tests 413
ℹ pass 411
ℹ fail 0
ℹ skipped 2
ℹ duration_ms ~2400

$ npm run lint
✖ 9 problems (0 errors, 9 warnings — all pre-existing)

PoC verification

poc-csrf.mjs (the script used to report the blocker on 2026-09-01) on this branch:

=== SUMMARY ===
  CORS allows cross-origin read:  NO (safe)
  Local bypass on cross-origin:   NO (401)
  Bootstrap token leak count:     0/2
>>> PoC did not reproduce the blocker
exit 0

UX trade-off

A small one-click convenience (auto-HEADERS-update on token rotation) is gone. The operator must now:

1. Trigger the rotation (POST /api/settings or the UI button)
2. Read the new value from server stdout (where settings.js prints it on rotation) OR from ~/.mcode-webui/settings.json
3. Re-open the webui URL with ?token=<new-value> appended

The SPA shows an 8-second toast guiding the user. See SECURITY-NOTES.md §10 for the full contract.

Relationship to other PRs

• fix(mcode-webui): round 8 — CORS tightening + cross-origin token-leak fix Wzdhehe/Mcode-webui#6 — already merged (2026-09-04 by Wzdhehe at 072220c). This PR mirrors that merge into the marketplace layout.
• MiniMax-Code-Plugins#16 (the original marketplace PR) — stale at 564af66. hetaoBackend has 3 CHANGES_REQUESTED reviews on it. The author (Wzdhehe) should close Add plugin: mcode-webui (Wzdhehe) #16 in favor of this PR.

Reviewer checklist for the marketplace maintainer

• npm test → 0 fail (verified locally: 411/0/2)
• npm run lint → 0 errors (verified: 0 errors, 9 pre-existing warnings)
• poc-csrf.mjs against the built server → no cross-origin token leak (verified)
• Diff matches Wzdhehe/Mcode-webui#6 (round 8 commit 7acdfe9 plus the merge base 92cae0c)
• Close Add plugin: mcode-webui (Wzdhehe) #16 in favor of this PR

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[hetaoBackend]

Current head 16ebfab substantially tightens CORS and removes the currentToken field, and the local unit suite reports 411 pass / 0 fail / 2 skipped. A material token-disclosure blocker remains: server/lib/settings.js:691-700,735-736 puts the bearer credential into lanUrlWithToken; server/routes/settings.js:28-30 returns the full settings snapshot; server/router.js:337-340 exempts /api/settings from the LAN guard; and server/lib/auth.js:130-139 authorizes loopback requests without a token. The settings response therefore still exposes a token-bearing URL through an unauthenticated local bootstrap surface, contrary to the security comments claiming the token is never echoed over HTTP. Remove lanUrlWithToken from HTTP/SSE snapshots or expose it only through an explicitly authenticated user-triggered path. Also package.json advertises validate:plugin and verify scripts whose files are absent; either restore those files or correct the package scripts. [code]smith is SKIPPED.