Security: Enforce a session boundary for local control APIs and WebSockets #102

Summary

A simple cross-origin POST reached the runtime-start handler, and an arbitrary-origin WebSocket was accepted at main.py:1098. There is no application session authentication for execution or lifecycle mutations. A restrictive CORS response policy does not itself authorize requests or prevent every mutation.

Environment and evidence

• Review finding: F02 (2026-10-05 product/technical review).
• Baseline: Windows, dev at c1c5dbe. The remote dev matched this commit when filing.
• Evidence: Reproduced + Code.
• Priority recommendation: P1 - proposed first-release blocker. This is review triage, not a production-incident severity declaration.
• No real credentials, paid inference, engine installation, or unrelated process termination were used for review probes. Mocked observations establish the stated code behavior, not live-provider/GPU acceptance.

Reproduction or validation

Isolated handler tests accepted an unrelated Origin on a control POST and on an execution WebSocket. The fixture had no installed engine, so no engine was started. This demonstrates missing application-side checks, not a complete browser exploit; private-network restrictions can affect browser reachability.

User impact

An untrusted client that can reach the service can trigger execution or lifecycle actions. Browser private-network restrictions may constrain a particular web attack; the probe does not claim a complete browser exploit.

Proposed approach

Require a per-launch session credential, validate origins on browser-facing writes and WebSocket handshakes, and test unauthorized install, stop, shutdown, execution, and secret reads.

Acceptance criteria

• Require a per-launch session credential for sensitive reads and mutations.
• Validate browser origins for mutations and WebSocket handshakes.
• Unauthorized execution, install, stop, shutdown, and secret reads are rejected.
• Supported desktop/browser origins continue to work without widening access.

Related work

Related closed issue: #58. The earlier wildcard-CORS issue is closed. This report concerns application session/origin authorization remaining after that configuration change.

Verification scope

Real GPU inference, paid-provider compatibility, and a clean-machine packaged desktop journey remain unverified. Any follow-up implementation should target dev under the repository's contribution/branching rules.