fix(server): restrict plaintext sideband overrides to numeric loopback

[luvs01]

Summary

• restrict plaintext Realtime sideband overrides to numeric IPv4 addresses in the 127.0.0.0/8 range;
• preserve localhost and IPv6 loopback handling;
• reject DNS names that merely begin with 127. and fall back to the canonical secure Realtime endpoint;
• add positive and negative regression coverage for the hostname boundary.

Why

The plaintext development exception used hostname.startsWith("127."). A configured URL such as http://127.evil.example/v1 therefore passed the loopback check even though it names a remote DNS host. The resulting sideband connection is created with the resolved upstream authorization headers and transparently relays Realtime frames.

This override is deliberately configuration-file-only and has no management API or GUI write surface, so the practical precondition is trusted local configuration. The fix nevertheless restores the documented invariant that plaintext http/ws is accepted only for loopback destinations.

Verification

• Bun 1.3.14: tests/server-live.test.ts 27/27 passed.
• Bun 1.4.0-canary.1 (b22e0e6d0): the same file 27/27 passed.
• bun x tsc --noEmit: passed.
• bun scripts/privacy-scan.ts: passed.
• git diff --check: passed.

Security boundary

The change narrows a credential-destination check. It does not add a new configuration or network surface. Plaintext remains available for numeric 127/8, localhost, and IPv6 loopback development endpoints; all other plaintext hostnames fail closed to wss://api.openai.com/v1.

Checklist

• Numeric IPv4 loopback compatibility is covered.
• Deceptive 127.* DNS names are rejected.
• Existing sideband relay and readiness tests remain green.

Ready for review; upstream CI and the repository-required maintainer security review for credential-destination changes remain pending.

Summary by CodeRabbit

• Bug Fixes
  • Improved loopback address validation to accept only valid IPv4 loopback addresses.
  • Prevented hostname-like and out-of-range values from being incorrectly accepted.
  • Preserved support for localhost, .localhost, and IPv6 loopback addresses.
  • Expanded validation coverage for additional loopback scenarios.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Loopback validation

Layer / File(s)	Summary
Validate and test loopback hosts src/server/live.ts, tests/server-live.test.ts	At src/server/live.ts:210-215, isLoopbackHost now requires four numeric IPv4 octets in the 0–255 range. Tests confirm 127.0.0.2 rewrites to WebSocket and invalid or deceptive hosts use the canonical upstream URL.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: ingwannu, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: restricting plaintext sideband overrides to numeric loopback addresses.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/server-live.test.ts`:
- Around line 641-642: Add the out-of-range IPv4 URL http://127.256.0.1/v1 to
the existing negative fallback test table alongside the deceptive hostname
cases, and assert that it resolves to the canonical upstream URL using the same
verification path.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 97954408-b8e4-4d0b-9b6c-7f1d5ff972a0

📥 Commits

Reviewing files that changed from the base of the PR and between fdc47db and d8c72ee.

📒 Files selected for processing (2)

• src/server/live.ts
• tests/server-live.test.ts

[github-actions]

⏳ DRAFT

• UI screenshot required.

What to do

• Add a screenshot of the UI change to the PR description.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request is being kept as a draft automatically. Once every issue above is resolved, it will be marked ready for review again.
@luvs01 Tick the boxes once your local CI is green, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[luvs01]

Rebased exact head fe25d729 onto current dev (517f4460) and preserved the reviewed two-file scope. The out-of-range 127.256.0.1 regression remains included.

Focused verification on the rebased state:

• Bun 1.3.14: tests/server-live.test.ts 27/27 passed.
• Bun 1.4.0-canary.1: 27/27 passed.
• Typecheck, privacy scan, and git diff --check passed.

The branch is now exactly one commit ahead and zero behind dev; exact-head upstream CI and maintainer security review remain pending.

[lidge-jun]

Approved the pending Cross-platform CI run at this exact head, and it came back green.

Worth explaining the silence beforehand: contributor PRs queue their workflow runs as action_required until a maintainer releases them, and gh pr checks does not show that state — so from your side it looks like nothing is happening rather than like something is waiting on us. That was ours to clear, not yours.

To be precise about what this does and does not do: it only unblocks CI. It does not make this mergeable. The four-box readiness checklist in the description is your attestation, and the gate keeps the PR in draft until you complete it. With CI now green at your head, box 1 is provable.

If anything in the run looks wrong to you, say so and I will dig into it rather than leaving you to guess.