[yultyyev]

What

clip ui's local API (/api/*) now turns away requests that didn't come from the UI itself:

• Host check: a request whose Host name isn't 127.0.0.1 or localhost gets a 403. Any port is allowed, so the Vite dev proxy (which forwards the browser's localhost:5173) keeps working.
• Origin check: Hono's built-in csrf() middleware rejects cross-site writes. It covers text/plain, form and Content-Type-less POSTs, the ones a browser sends without a CORS preflight.

Both are registered on /api/* in startUiServer (src/ui/server.ts). Static UI files are unchanged.

Why

The server binds 127.0.0.1 on a predictable port (5573) and had no request middleware. The handlers parse bodies with c.req.json(), which accepts any Content-Type. So:

• any web page the user visits while clip ui is running could send fetch('http://127.0.0.1:5573/api/…', { method: 'POST', mode: 'no-cors', body: '{…}' }) and drive mutating endpoints (tools, timeline verbs, export, snapshot/undo, import);
• a DNS-rebinding page (attacker domain resolving to 127.0.0.1) is same-origin from the browser's point of view, so it could also read responses.

AGENTS.md non-negotiable #3 confines clip ui callers to the workspace. That only holds if the caller is the user's own UI.

Not covered here: the snapshot-label path validation flagged on skills.sh. That's a separate change.

How to test

pnpm vitest run tests/ui-request-guard.test.ts

The new test starts the real server and sends raw HTTP with chosen Host/Origin headers. On main, the 4 attack cases all returned 200. With this change they return 403, and the 4 legitimate cases (same-origin UI write, Vite proxy write, no-Origin JSON client, localhost read) return 200.

Checks

• pnpm test: pass, 783 passed, 24 skipped (46 files passed, 7 skipped)
• pnpm type-check: pass
• pnpm lint: pass, 0 errors. The 7 warnings are the same ones already on main, none in changed files.
• pnpm build (tsup + Vite UI): pass
• Real browser: ran the server on a test workspace and loaded the UI through vite dev (VITE_API_PORT → the test server). All UI API calls returned 200 and a same-origin snapshot POST returned 200. A no-cors cross-origin POST from http://localhost:5591 to http://127.0.0.1:5591 was refused (403) and created no snapshot.
• Codex review (codex review --base origin/main, gpt-6.1-sol, read-only): no findings. "No actionable regressions were identified."
• The gstack /verify wrapper needed a one-time trust grant for repo commands. Instead of granting it, I ran the same four commands above directly on this commit.

Release impact

fix(ui) → patch release on merge (angular preset).

[github-actions]

🎉 This PR is included in version 0.4.2 🎉

The release is available on:

• v0.4.2
• GitHub release

Your semantic-release bot 📦🚀