fix(dashboard): N50 — /setup and /setup/agent never send the API key to localhost:3200

[LamaSu]

Gate A, HIGH: N50 (steward #2640; product-steward #2602). Dashboard only. Base: master. Head 74f758b answers coord-watch's DO-NOT-SHIP (#2857); see "Review round 1".

The leak

• SetupWizardPage.tsx:53 fetched http://localhost:3200/api/capabilities with the signed-in user's Authorization: Bearer <key> on every /setup load, in every build. It then claimed "Gateway connected at localhost:3200".
• SetupAgentPage defaulted gatewayUrl to http://localhost:3200 for its three key-bearing requests (/api/setup/scan-network, /api/ai/identify-machine, /api/setup/register-device), and its only caller (line 901) never overrode it.

In production, both handed the user's key to whatever process listens on port 3200 of their own machine.

The fix

• lib/gateway-base.ts holds the configured gateway: same-origin in production, or VITE_PCC_URL, which the auth store already uses to validate the key. It is the only origin that may receive the key.
• SetupWizardPage: the liveness check now hits the public /api/health with no key, and the page says "Gateway reachable".
• SetupAgentPage: it defaults to the configured gateway. Only line 80 changes; adk owns the rest of the page (bus #2544).

Review round 1: coord-watch DO-NOT-SHIP (#2857), fixed at 74f758b

Sol found that the setup leak was fixed but the key was still attached regardless of destination. Each finding and its fix:

1. Two credential destinations. Relative /api callers went to the dashboard origin, and gateway-base callers to VITE_PCC_URL. Fix: there is one gateway origin. fetchWithKey() (lib/gateway-base.ts) is the only code that puts a key on a request. It resolves the final URL (including //host and /..//host), refuses any other origin before making a request, and only then adds the header. It is reached through authorizedFetch() (lib/authorized-fetch.ts). These now use it:
   • lib/api.ts;
   • api/gateway.ts (every react-query hook);
   • the auth store's key check;
   • SetupAgentPage;
   • EarnFromYourWorkPage, which sent its new key to http://localhost:3200 in dev builds and to https://capability.network in production builds, even from staging.
2. VITE_PCC_URL was not validated. Fix: it must be an absolute https: origin; http: is accepted only on loopback in a dev build. A bad value fails closed: no request carries a key, and the reason is logged once.
3. The guard caught only literal localhost URLs. Fix:
   • installKeyEgressGuard() runs first in main.tsx. It rejects any fetch that carries a pcc_live_/pcc_test_ key, or the stored key, to another origin, whether in a header, the URL or a string body. The refusal message never includes the query string.
   • __tests__/no-direct-auth-headers.test.ts enforces "key construction only inside the wrapper" as a shrink-only ratchet. It lists 31 legacy modules with their owning lanes, and fix(dashboard): no production mock — pages show live data, say they aren't live, or say they couldn't load (Wave 0, D8) #408 removes 5 of them.
   • The literal-origin guard stays as the narrow check; EarnFromYourWorkPage has left its list.

Also: SetupAgentPage's gatewayUrl parameter is gone (product-steward, #2849).

Tests

• Dashboard 264/264 (+39: gateway-base.test.ts 32, ratchet 4, setup/earn page tests 3). tsc and the build are clean.
• Negative controls: removing the origin check fails 6 tests; accepting any scheme, 6; a pass-through guard, 3; not installing the guard at startup, 1; restoring master's EarnFromYourWorkPage, lib/api.ts or api/gateway.ts fails 3, 2 and 2.
• Browser trace, 13/13 (returns/pcc-shell-work/e2e-n50-20260924/). It ran a real gateway (production mode) and a sink server on another origin:
  • signed-in reads carry the key to the gateway only;
  • /setup's liveness check carries no key, and nothing goes to :3200;
  • five hand-built key-bearing requests to the sink were refused in the browser, and the sink received the key 0 times;
  • a production build with VITE_PCC_URL=http://… sent no key-bearing request at all.
• Merge dry runs with fix(dashboard,ui): live StatusBar, honest Settings, and a failed read is not an empty result #352 and fix(dashboard): one route model (the URL decides), real Agent mode, retire AgentChatPage #354 are clean. fix(dashboard): one route model (the URL decides), real Agent mode, retire AgentChatPage #354's FeedbackButton was moved onto the shared client so the ratchet stays green in the merged tree.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VU6exGFC7uLukeDF2GBUpQ