fix(wallet): harden browser-signing bridge (security review)

[MuncleUscles]

Summary

Targeted hardening of the browser-wallet signing bridge per a security review. The bridge is otherwise sound — this keeps all existing behavior and tests intact and only closes the flagged gaps. Existing no-CORS, origin-fail-closed, and token-on-every-route checks are unchanged.

Changes

• MEDIUM — Verify signer + handle account switch. Reject a wallet result whose from differs from the connected/expected signer, both in the bridge (browserBridge.ts handleResult) and in browserSend.ts (assertResultSigner); from is plumbed through sessionClient.ts waitForTxResult. On accountsChanged, the page re-POSTs /api/connected so the daemon stays coherent (aborts on disconnect), and the misleading "The CLI will verify the sender" copy now matches the enforced behavior.
• LOW — Constant-time token compare. Length-guarded crypto.timingSafeEqual.
• LOW — Host-header validation. Reject Host != 127.0.0.1:<port> / localhost:<port> with 403 before route dispatch. Validated against the port captured at start() so a long-poll flushed during teardown still passes.
• LOW — ~/.genlayer perms. Config + keystores dirs created {recursive:true, mode:0o700} and chmodSync(dir, 0o700).
• LOW — Scrub token from URL. history.replaceState after reading the hash token.
• LOW — Body cap. Abort request bodies past 64KB with 413.
• Doc. Warn against ssh -g / GatewayPorts yes / binding a public interface where port-forwarding is suggested.

Tests

• New: mismatched-from result is rejected with a clear signer-mismatch error (account-switch case).
• New: non-loopback Host header is rejected (403) while loopback (127.0.0.1 / localhost) is served.
• Updated existing configFileManager and sessionClient tests for the 0700 perms and the waitForTxResult {txHash, from} shape.

Verification

• npm run build clean.
• npx vitest run → 749 passed (72 files); +2 new hardening tests.
• tsc --noEmit → 32 errors, identical to the pre-existing baseline (zero new; none in touched files).
• No version bump.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a50b0748-f074-45ca-9e5f-c6ff86c0c36e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/cli-bridge-secreview

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}