## Summary
- Narrows `is_session_expired_error` in `src/core/jsonrpc.rs` so `DomainEvent::SessionExpired` only fires for **confirmed OpenHuman session expiry**, not for downstream provider 401s.
- Adds `is_downstream_provider_auth_error` helper for diagnostic logging only (no session side-effects).
- Adds `'provider_auth'` error kind to `CoreRpcErrorKind` in `coreRpcClient.ts`; tightens `classifyRpcError` with the same HTTP-method-prefix logic.
- Fixes Discord card-click logout (issue #2285) as a direct consequence.
## Root Cause
`is_session_expired_error` used a loose `"401 + unauthorized"` string match. Discord bot-token failures arrive as `"Discord API error: Discord list guilds failed (401): Unauthorized"` — which contains both "401" and "unauthorized" — causing the full user session to be cleared on every Discord card interaction.
## Fix
OpenHuman backend errors (from `authed_json` in `src/api/rest.rs`) always use the format `"{HTTP_METHOD} /path failed (401 Unauthorized): {body}"`. Provider errors start with the provider name. The fix keeps the `"401 + unauthorized"` branch only when the message starts with an HTTP method verb, which matches backend paths while excluding Discord, OpenAI, Anthropic, Composio, etc.
## Test plan
- [x] `src/core/jsonrpc_tests.rs` — 10 `is_session_expired_error` tests covering: HTTP-method-prefix matches, Discord exclusion, BYO-key exclusion, Composio exclusion, explicit markers still match
- [x] `app/src/services/__tests__/coreRpcClient.test.ts` — 3 new `test.each` rows: Discord/OpenAI/Anthropic 401 → `provider_auth`; existing `GET /teams failed (401 Unauthorized)` → `auth_expired` preserved
- [x] `cargo test -p openhuman is_session_expired` — 10/10 pass
- [x] `pnpm test:coverage` — full Vitest suite pass
- [x] `pnpm compile` + `cargo check` — clean
- [x] `pnpm format:check` — clean
## Submission Checklist
- [x] Tests added or updated (happy path + at least one failure / edge case)
- [x] Diff coverage ≥ 80% — all new/changed lines in `jsonrpc.rs` and `coreRpcClient.ts` covered by unit tests
- [x] No new external network dependencies introduced
- [x] N/A: Coverage matrix — no new production feature rows
- [x] N/A: Manual smoke checklist — no release surfaces touched
## Related
Closes#2286
Related: #2285 (Discord card-click logout — fixed as a consequence of this change)
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
### Linear Issue
- Key: N/A
- URL: N/A
### Commit & Branch
- Branch: `fix/session-expired-cascade-2286`
- Commit SHA: a0da2423
### Validation Run
- [x] `pnpm --filter openhuman-app compile`
- [x] `pnpm --filter openhuman-app format:check`
- [x] `pnpm --filter openhuman-app lint`
- [x] `cargo check --manifest-path Cargo.toml`
- [x] `pnpm test:coverage` (Vitest full suite)
- [x] `cargo test -p openhuman is_session_expired` (10/10 pass)
### Validation Blocked
- `command:` N/A
- `error:` N/A
- `impact:` N/A
### Behavior Changes
- Intended behavior change: provider-auth 401s (Discord, OpenAI BYO-key, Composio direct-mode) no longer clear the user session
- User-visible effect: clicking the Discord channel card no longer logs the user out; BYO-key misconfiguration no longer forces re-auth
### Parity Contract
- Legacy behavior preserved: OpenHuman backend 401s (`GET /teams failed (401 Unauthorized)`) still trigger session expiry
- Guard/fallback/dispatch parity checks: `api_error` in `inference/provider/ops.rs` still publishes SessionExpired directly for backend auth failures (independent of this fix)
### Duplicate / Superseded PR Handling
- Duplicate PR(s): none
- Canonical PR: this PR
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved error classification to distinguish user session expiry from external provider authentication failures, reducing mistaken session terminations and improving recovery and logging behavior.
* **Tests**
* Expanded and tightened test coverage to ensure confirmed session-expiry signals are detected while external API 401/unauthorized responses do not trigger session-expiry handling.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2356?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: M3gA-Mind <megamind@mahadao.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Extends `expected_error_kind` matcher ladder with 11 new substring arms across two existing buckets — no new variants, no new emit sites, no behavior change beyond reclassifying known wire shapes that were leaking past Wave 1-3 anchors.
- Closes 13 Sentry IDs (~366 events) — **all deterministic user-environment / user-config errors with no remediation path** (offline, DNS fail, captive portal, bad API key, out of credits, wrong model id, missing OAuth scope, region block).
- Pure classifier — no UI, retry, or fallback logic touched. The reliable-provider stack still falls back to OpenHuman's hosted tier for the Lane O bodies; users keep their chat. Lane N socket failures already gated through `report_error_or_expected` at `ws_loop.rs:191`, so the threshold-escalation event simply demotes to a `warn` breadcrumb instead of paging.
- Two micro-commits — Lane O (`is_provider_config_rejection_message` PHRASES const) and Lane N (`is_network_unreachable_message` substring arms) — each independently revertible.
## Problem
After the Wave 1-3 sweep landed, fresh Sentry triage surfaced **13 unresolved IDs** whose bodies match the *spirit* of an existing classifier bucket but use wire-shape variants the current substring anchors miss:
### Lane O — custom-provider config rejection (~250 events)
The `ProviderConfigRejection` variant + `is_provider_config_rejection_message` exist precisely for "user pointed OpenHuman at a custom_openai endpoint with a model / temperature / region / credential that provider doesn't accept." But the 7 phrases shipped in Wave 1-3 (#2079 / #2076 / #2202) only cover the DeepSeek / OpenRouter abstract-tier-leak and Moonshot temperature shapes. New surfaces:
| Sentry ID | Events | Real wire body |
|---|---|---|
| `R1` | 44 | `{"error":{"message":"This model is not available in your region.","code":403}}` |
| `R4` | 14 | `{"code":403,"reason":"ModelNotAllowed","message":"模型不允许访问"…}` (Doubao/ChatGLM) |
| `YC` | 16 | `{"error":{"type":"invalid_authentication_error"…}}` |
| `S5` | 14 | `{"error":{"message":"This request requires more credits, or fewer max_tokens…"}}` (OpenRouter 402) |
| `Y0` | 13 | `{'error': '/chat/completions: Invalid model name passed in model=reasoning-v1…'}` |
| `JN` | 14 | `{"error":{"message":"No active credentials for provider: openai"…}}` |
| `KB` | 16 | Same `No active credentials for provider` shape from OpenHuman backend re-emit |
| `JK` | 17 | `litellm.BadRequestError: Github_copilotException - Bad Request…` |
| `J2` / `J5` / `J4` | 62 | `{"error":{"message":"model 'llama3.3' not found","type":"not_found_error"…}}` |
### Lane N — socket WebSocket-connect transport (~116 events)
`is_network_unreachable_message` already catches `connection refused` / `dns error` / `network is unreachable` but two real shapes escape:
| Sentry ID | Events | Real wire body |
|---|---|---|
| `44` | 50 | `[socket] Connection failed: WebSocket connect: IO error: failed to lookup address information: nodename nor servname provided, or not known` |
| `4P` | 66 | `[socket] Connection failed: WebSocket connect: HTTP error: 200 OK` (captive portal / corporate proxy intercepting the WS upgrade handshake) |
Every one of these is deterministic **user-environment** / **user-configuration** state — the maintainers have no remediation. Sentry has no signal to act on. Every event was pure noise.
## Solution
### Lane O — `src/openhuman/inference/provider/config_rejection.rs:55-79`
Append 8 new phrases to the `PHRASES` const (case-insensitive substring match, same precedence as existing 7):
```rust
"not available in your region", // R1
"modelnotallowed", // R4
"invalid_authentication_error", // YC
"requires more credits", // S5
"invalid model name passed in model=", // Y0
"no active credentials for provider", // JN + KB
"litellm.badrequesterror", // JK
"not_found_error", // J2 + J5 + J4
```
Each anchor is intentionally narrow (e.g. `passed in model=` not bare `invalid model name`; `litellm.badrequesterror` not bare `litellm`) so a stray log line elsewhere can't accidentally demote a real provider/backend bug. The HTTP-layer wrapper (`is_provider_config_rejection_http`) still guards on `provider != openhuman_backend::PROVIDER_LABEL`, so a model rejection from **our own** backend (which would be a real regression) still reaches Sentry.
### Lane N — `src/core/observability.rs:299-319`
Three new substring arms appended to `is_network_unreachable_message`:
- `failed to lookup address` + `nodename nor servname` — libc `getaddrinfo()` failure renderings on macOS / BSD / POSIX resolvers when tungstenite wraps as `IO error` without the reqwest `dns error` prefix.
- `http error: 200 ok` — tungstenite-only render. Reqwest renders HTTP 200 as `"HTTP status server error (200)"`, so no collision with the regular HTTP call path. A negative precedence test (`http_200_classifier_does_not_silence_unrelated_log_lines`) pins this against benign `HTTP/1.1 200 OK` / `status: 200 OK` prose so a future broadening cannot silence success traces.
### Design trade-off — classifier vs. root-fix validation layer
The Lane O bugs *do* have a more durable root fix: a pre-save provider validation layer (test the API key, validate the model id against `/v1/models`, surface region-blocks at config-save time). That's a real product initiative requiring UX design, per-provider model-list infrastructure, and meaningful spec work — out of scope for a triage sweep. This PR follows the Wave 1-3 maintainer precedent (classifier-first noise suppression) so the Sentry signal/noise ratio improves immediately; the validation layer remains tracked as a separate follow-up. If/when it lands, these classifier arms become redundant belt-and-suspenders and can be deleted without conflict.
Lane N has no root-fix alternative — offline / firewall / captive-portal / DNS failures are pure user-environment state. Classifier-demote is the correct disposition.
## Submission Checklist
> If a section does not apply to this change, mark the item as `N/A` with a one-line reason. Do not delete items.
- [x] Tests added or updated (happy path + at least one failure / edge case) per [Testing Strategy](../gitbooks/developing/testing-strategy.md#failure-path-requirement)
- [x] **Diff coverage ≥ 80%** — changed lines (Vitest + cargo-llvm-cov merged via `diff-cover`) meet the gate enforced by [`.github/workflows/coverage.yml`](../.github/workflows/coverage.yml). 11 positive tests pinned to real Sentry bodies + 1 negative precedence test cover every new substring arm; only the rustdoc comments and the negative `unrelated_*` test body are non-executable lines.
- [x] N/A: behaviour-only change — Coverage matrix updated — added/removed/renamed feature rows in [`docs/TEST-COVERAGE-MATRIX.md`](../docs/TEST-COVERAGE-MATRIX.md) reflect this change
- [x] All affected feature IDs from the matrix are listed in the PR description under `## Related`
- [x] No new external network dependencies introduced (mock backend used per [Testing Strategy](../gitbooks/developing/testing-strategy.md#mock-policy))
- [x] N/A: classifier-only change with no UI / release-cut surface touched — Manual smoke checklist updated if this touches release-cut surfaces ([`docs/RELEASE-MANUAL-SMOKE.md`](../docs/RELEASE-MANUAL-SMOKE.md))
- [x] Linked issue closed via `Closes #NNN` in the `## Related` section
## Impact
- **Runtime**: no behavior change for users — chat / agent / web-channel / socket paths continue to fall back / retry exactly as before. The only delta is that `report_error_or_expected` now classifies these 13 wire shapes as `ExpectedErrorKind::*` instead of escalating as `tracing::error`, so Sentry stops receiving the events.
- **Performance**: negligible — `is_provider_config_rejection_message` lowercases once and runs 15 substring scans (was 7); `is_network_unreachable_message` runs 11 substring scans (was 8). Both already on the error-path, never on the hot path.
- **Security**: no new attack surface. Substring matchers run on already-rendered error messages — no parsing, no allocation beyond the existing `to_ascii_lowercase()`.
- **Migration**: none.
- **Compatibility**: forward-compatible. New phrases are append-only — no existing matcher behavior changes. If a future maintainer ships the root-fix validation layer, deleting these arms is a clean local edit.
## Related
- Closes OPENHUMAN-TAURI-R1
- Closes OPENHUMAN-TAURI-R4
- Closes OPENHUMAN-TAURI-YC
- Closes OPENHUMAN-TAURI-S5
- Closes OPENHUMAN-TAURI-Y0
- Closes OPENHUMAN-TAURI-JN
- Closes OPENHUMAN-TAURI-KB
- Closes OPENHUMAN-TAURI-JK
- Closes OPENHUMAN-TAURI-J2
- Closes OPENHUMAN-TAURI-J5
- Closes OPENHUMAN-TAURI-J4
- Closes OPENHUMAN-TAURI-44
- Closes OPENHUMAN-TAURI-4P
- Follow-up PR(s)/TODOs: pre-save provider-validation layer (validate API key + model id + region at config-save time) tracked as separate product initiative; would supersede the Lane O arms.
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
> Keep this section for AI-authored PRs. For human-only PRs, mark each field `N/A`.
### Linear Issue
- Key: N/A (Sentry-driven triage; no Linear ticket)
- URL: N/A
### Commit & Branch
- Branch: fix/sentry-wave4-classifier-no
- Commit SHA: e16414ac (tip)
### Agent
- Claude Code (Sonnet 4.6) running locally
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced detection of network connectivity failures and provider configuration rejection scenarios for more accurate error classification.
* **Tests**
* Added comprehensive test coverage for network-related transport failures and provider configuration rejection cases.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2309?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: oxoxDev <nikhil@tinyhumans.ai>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Replaces wildcard Core RPC CORS behavior with an explicit allowlist for Tauri and loopback origins.
- Preserves existing `Vary` response values while appending `Origin`.
- Removes unsafe process-global env mutation from CORS tests by injecting env override input directly.
- Adds regression coverage for env override exact matching and existing `Vary` preservation.
## Problem
- `src/core/jsonrpc.rs` emitted `Access-Control-Allow-Origin: *`, so any browser origin that obtained the bearer token could call the local RPC surface.
- The prior fix in #2266 addressed the core issue but still had two review blockers: unsafe env mutation in parallel Rust tests and overwriting existing `Vary` headers.
- I could not push directly to #2266's fork branch, so this PR carries the same security fix plus the review follow-ups.
## Solution
- Keep `is_origin_allowed(origin)` as the production env-reading entry point.
- Add `is_origin_allowed_with_extra(origin, extra_origins)` so tests can exercise override parsing without mutating process-global environment.
- Change `with_cors_headers` from `headers.insert(Vary, Origin)` to `headers.append(Vary, Origin)`.
- Add focused tests for existing `Vary` preservation and exact-match override behavior.
## Submission Checklist
- [x] Tests added or updated (happy path + at least one failure / edge case) per [Testing Strategy](../gitbooks/developing/testing-strategy.md#failure-path-requirement)
- [x] **Diff coverage ≥ 80%** — changed lines (Vitest + cargo-llvm-cov merged via `diff-cover`) meet the gate enforced by [`.github/workflows/coverage.yml`](../.github/workflows/coverage.yml). CI coverage gate must confirm this; local focused Rust tests cover the changed paths.
- [x] Coverage matrix updated — N/A: security boundary fix covered by focused Rust tests; no feature matrix row added/removed/renamed.
- [x] All affected feature IDs from the matrix are listed in the PR description under `## Related` — N/A: no coverage-matrix feature row applies.
- [x] No new external network dependencies introduced (mock backend used per [Testing Strategy](../gitbooks/developing/testing-strategy.md#mock-policy))
- [x] Manual smoke checklist updated if this touches release-cut surfaces — N/A: Core RPC header behavior only; no manual release checklist surface changed.
- [x] Linked issue closed via `Closes #NNN` in the `## Related` section
## Impact
- Security: arbitrary non-allowlisted browser origins no longer receive ACAO for local Core RPC responses.
- Compatibility: Tauri webview origins, loopback dev/E2E origins, and non-browser callers remain supported.
- Operators can still add exact additional debug origins with `OPENHUMAN_CORE_ALLOWED_ORIGINS`.
## Related
- Closes#2262
- Supersedes #2266 because I do not have permission to push review fixes to `leighstillard/fix/cors-allowlist`.
- Follow-up PR(s)/TODOs: none.
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
### Linear Issue
- Key: N/A
- URL: N/A
### Commit & Branch
- Branch: `fix/2262-cors-allowlist`
- Commit SHA: `9d1341cff29ef1e1b08721885124ce3267f4a99d`
### Validation Run
- [x] `pnpm --filter openhuman-app format:check` — N/A: Rust-only Core RPC change.
- [x] `pnpm typecheck` — N/A: Rust-only Core RPC change.
- [x] Focused tests: `GGML_NATIVE=OFF cargo test --manifest-path Cargo.toml cors_tests --lib` — 8 passed.
- [x] Rust fmt/check (if changed): `cargo fmt --manifest-path Cargo.toml --all`; `GGML_NATIVE=OFF cargo check --manifest-path Cargo.toml --lib`; `git diff --check`.
- [x] Tauri fmt/check (if changed): N/A: Tauri shell unchanged.
### Validation Blocked
- `command:` N/A
- `error:` N/A
- `impact:` N/A
### Behavior Changes
- Intended behavior change: Core RPC only echoes `Access-Control-Allow-Origin` for allowlisted browser origins instead of wildcard `*`.
- User-visible effect: none expected for packaged app, loopback dev, E2E, or non-browser callers.
### Parity Contract
- Legacy behavior preserved: Tauri origins, loopback origins, debug env overrides, CORS methods/headers/max-age, and no-Origin non-browser callers remain supported.
- Guard/fallback/dispatch parity checks: focused CORS unit tests cover allowed origins, denied origins, no-Origin callers, exact env override matching, and preserved `Vary` values.
### Duplicate / Superseded PR Handling
- Duplicate PR(s): #2266
- Canonical PR: this PR if maintainers prefer an immediately updated branch; otherwise #2266 can cherry-pick `9d1341cff29ef1e1b08721885124ce3267f4a99d`.
- Resolution (closed/superseded/updated): #2266 remains open; this PR carries the requested review fixes because direct push to the fork branch was denied.
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **Bug Fixes**
* Tightened CORS handling to enforce an origin allowlist; only trusted local schemes and loopback addresses are allowed by default, and disallowed origins no longer receive CORS responses.
* **Chores**
* Added support for configuring extra allowed origins via environment configuration.
* **Tests**
* Added comprehensive tests for allowlist decisions, header emission (including Vary behavior), and edge cases.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2328?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Leigh Stillard <leigh@stillard.com>
Co-authored-by: 李冠辰 <liguanchen@xiaomi.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
- Narrows JSON-RPC session-expiry detection to confirmed OpenHuman app-session shapes.
- Keeps generic downstream/provider `401 Unauthorized` and `invalid token` errors from publishing `SessionExpired`.
- Adds diagnostic logging that includes the RPC method and sanitized reason when an auth-like error is not treated as session expiry.
- Updates classifier tests for true session expiry, scoped 401s, and generic invalid-token text.
## Problem
- The previous JSON-RPC classifier treated any `401` + `unauthorized` text as a global app session expiry.
- That could clear the stored session and bounce users to sign-in for unrelated provider, integration, or channel errors.
- This is the root pattern behind the Discord card logout report.
## Solution
- Reuse the strict `observability::is_session_expired_message` classifier at the JSON-RPC dispatch boundary.
- Preserve `SessionExpired` publication for explicit OpenHuman auth states: `session expired`, `SESSION_EXPIRED`, `no backend session token`, and `session JWT required`.
- Add a diagnostics-only predicate for generic auth-looking errors so they are logged with method context but do not clear the session.
- Update comments in `observability` to match the stricter dispatch behavior.
## Submission Checklist
- [x] Tests added or updated (happy path + at least one failure / edge case) per [Testing Strategy](../gitbooks/developing/testing-strategy.md#failure-path-requirement)
- [x] **Diff coverage ≥ 80%** — local coverage run is blocked by missing libclang; CI coverage gate will verify changed lines.
- [x] Coverage matrix updated — N/A: behavior-only core classifier hardening, no feature row added/removed/renamed.
- [x] All affected feature IDs from the matrix are listed in the PR description under `## Related` — N/A: no matrix feature ID changed.
- [x] No new external network dependencies introduced (mock backend used per [Testing Strategy](../gitbooks/developing/testing-strategy.md#mock-policy))
- [x] Manual smoke checklist updated if this touches release-cut surfaces ([`docs/RELEASE-MANUAL-SMOKE.md`](../docs/RELEASE-MANUAL-SMOKE.md)) — N/A: no release smoke checklist surface changed.
- [x] Linked issue closed via `Closes #NNN` in the `## Related` section
## Impact
- Runtime: core JSON-RPC auth/error handling.
- User-visible: scoped provider/integration 401s should remain recoverable errors instead of logging the user out.
- Security/privacy: session-expiry reasons are sanitized before logging/publishing.
- Compatibility: explicit OpenHuman session-expired sentinels still clear the session as before.
## Related
- Closes#2286
- Refs #2285
- Follow-up PR(s)/TODOs: identify the exact Discord card-click RPC from user logs if the UI still needs a provider-specific error state.
---
## AI Authored PR Metadata (required for Codex/Linear PRs)
### Linear Issue
- Key: N/A
- URL: N/A
### Commit & Branch
- Branch: `codex/2286-session-expired-narrowing`
- Commit SHA: `6f98f1e28a113afd0ea47908d0a397ecfe681560`
### Validation Run
- [x] `pnpm --filter openhuman-app format:check` — N/A: no frontend changes.
- [x] `pnpm typecheck` — N/A: no TypeScript changes.
- [x] Focused tests: blocked locally; see Validation Blocked.
- [x] Rust fmt/check (if changed): `cargo fmt --check` passed.
- [x] Tauri fmt/check (if changed): N/A: no Tauri shell changes.
### Validation Blocked
- `command:` `cargo test --lib is_session_expired_error --manifest-path Cargo.toml`
- `error:` `whisper-rs-sys` build script could not find `clang.dll` / `libclang.dll`; `LIBCLANG_PATH` is unset in this Windows environment.
- `impact:` focused Rust tests could not run locally, but the changed classifier tests are included for CI.
### Behavior Changes
- Intended behavior change: generic provider/integration/channel `401 Unauthorized` text no longer publishes `DomainEvent::SessionExpired`.
- User-visible effect: users should not be logged out by a scoped downstream 401, including the suspected Discord card-click path.
### Parity Contract
- Legacy behavior preserved: explicit OpenHuman session expiry, uppercase `SESSION_EXPIRED`, missing backend session token, and missing session JWT still clear the app session.
- Guard/fallback/dispatch parity checks: classifier tests cover true session expiry, generic 401, invalid token, and local missing-session cases.
### Duplicate / Superseded PR Handling
- Duplicate PR(s): none found for #2286/#2285 at PR creation time.
- Canonical PR: this PR.
- Resolution (closed/superseded/updated): N/A
Co-authored-by: aqilaziz <gonzes7@gmail.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
## Summary
Replaces `Access-Control-Allow-Origin: *` on the in-process JSON-RPC server with an explicit allowlist tied to the origins we actually ship. Possession of the per-launch bearer token is no longer sufficient for an arbitrary browser origin to call `/rpc`.
Closes#2262.
## What changes
`src/core/jsonrpc.rs`:
- New `is_origin_allowed(origin)` matches against:
- Tauri v2 webview origins: `tauri://localhost`, `http://tauri.localhost`, `https://tauri.localhost`
- Loopback hosts on any port: `http://127.0.0.1:*`, `http://localhost:*`, `http://[::1]:*` (Vite dev server, E2E harnesses)
- Comma-separated env override `OPENHUMAN_CORE_ALLOWED_ORIGINS` for operator-controlled debug harnesses
- `cors_middleware` reads the request's `Origin` header and passes it to `with_cors_headers`.
- `with_cors_headers(response, origin)`:
- Echoes the allowlisted origin in `Access-Control-Allow-Origin`.
- Omits the header for disallowed origins (the browser then refuses to surface the response).
- Always sets `Vary: Origin` so intermediate caches keep per-origin responses distinct.
- Non-browser callers (no `Origin` header) are unaffected.
- Logs a `tracing::warn!` line on rejected origins for diagnosis.
`src/core/jsonrpc_cors_tests.rs` (new, wired via `#[path]` like `jsonrpc_tests.rs`):
- Allowed Tauri origins return ACAO matching the request.
- Loopback hosts (IPv4, IPv6 literal, named, with/without port) allowed.
- Common disallowed origins (`https://attacker.example`, look-alike subdomains, `https://localhost`, `null`) refused with no ACAO header.
- Missing `Origin` header → no ACAO, but `Vary: Origin` still set.
- Env override allows exact-match additional origins; does not allow look-alike suffixes.
- `Allow-Methods`, `Allow-Headers`, and `Max-Age` are always set.
## Why
The bearer token is the only protection on `/rpc`. Possible token-leak paths include shared error logs, screenshots, Sentry breadcrumbs, or a malicious script inside a CEF child webview (Slack/Gmail/etc.). With wildcard CORS, possession of the token from *any* origin in any browser is sufficient — the desktop RPC surface includes shell tool calls, memory access, credential reads, and sending messages on the user's behalf, so the blast radius is high.
## Compatibility
- Tauri webview (`coreRpcClient.ts` `fetch()` path): `tauri://localhost` / `http(s)://tauri.localhost` are allowlisted. No frontend change required.
- `pnpm dev` (Vite at `http://localhost:1420`): allowlisted via the loopback rule.
- E2E (`tauri-driver` on `:4444`, Appium): allowlisted via the loopback rule.
- Non-browser callers (CLI, curl, integration tests that don't send `Origin`): unchanged.
- Debug harnesses on non-loopback origins: set `OPENHUMAN_CORE_ALLOWED_ORIGINS=https://my-harness,...`.
## Test plan
- [x] `cargo test --lib cors_tests` — 6 / 6 passing locally.
- [x] `cargo check --lib` — clean.
- [x] `cargo fmt --check` on changed files — clean.
- [ ] Smoke `pnpm dev:app` on the Tauri shell and confirm the frontend RPC fetches still succeed.
- [ ] CI: full test suite + coverage gate.
## Out of scope
Tracked as follow-ups from the same security audit:
- Webhook signature / replay verification.
- OS-keychain backing for the encryption master key.
- Prompt-injection enforcement (currently detect-only).
- Dual-channel trust model for scraped third-party content vs. user instructions.
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **New Features**
* Added CORS origin allowlisting with configurable environment variable support.
* Only approved origins (Tauri, loopback, and configured) can access the API.
* **Security**
* Replaced permissive cross-origin access policy with restrictive allowlist that rejects unknown origins.
* Disallowed origins no longer receive confirmation headers in responses.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2266?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Leigh Stillard <leigh@stillard.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
# Summary
- Upgraded Backend Health Endpoint: The `/health` route now performs a real-time check of all registered system components, returning `503 Service Unavailable` if any critical service is failing.
- Automated Uptime Monitor: Introduced a GitHub Actions workflow (`.github/workflows/uptime-monitor.yml`) that probes production and staging endpoints every 5 minutes.
- Stateful Alerting: Outages automatically trigger the creation of a labeled GitHub Issue and a Slack/Discord webhook notification.
- Auto-Recovery Tracking: The monitor detects when services return to a healthy state, automatically closing the tracking issue and notifying the team of the resolution.
- Operational Runbook: Added `docs/OPERATIONS.md` defining the escalation path (L1-L3), monitoring thresholds, and manual verification steps.
## Problem
Backend outages, such as API downtime and database connectivity issues, could previously go unnoticed until reported by users. The existing health endpoint was a static "liveness" probe that did not reflect the true operational state of internal components, and there was no external "ping-down" signal independent of the application itself.
## Solution
The implementation provides a multi-layered monitoring strategy:
1. Deep Health Checks: The Rust core now aggregates health signals from domain logic, including agents, memory, and channels, to provide a meaningful `/health` status.
2. External Validation: A GitHub Actions-based monitor, equivalent to Pingdom, provides the external perspective required to detect reachability issues.
3. Resilience: The monitor uses a retry-with-delay mechanism with 3 retries and a 5-second delay to eliminate noisy alerts from transient network blips.
4. Traceability: Using GitHub Issues for outage tracking ensures a historical log of downtime incidents directly in the repository.
## Submission Checklist
- [x] Tests added or updated (happy path + at least one failure / edge case) per [Testing Strategy](../gitbooks/developing/testing-strategy.md#failure-path-requirement)
- [x] Diff coverage ≥ 80% — New health logic in `jsonrpc.rs` and tests in `jsonrpc_tests.rs` meet coverage gates.
- [x] Coverage matrix updated — N/A: infrastructure/ops change
- [x] All affected feature IDs from the matrix are listed in the PR description under `## Related`
- [x] No new external network dependencies introduced (uses standard GHA script environment)
- [x] Manual smoke checklist updated if this touches release-cut surfaces ([`docs/RELEASE-MANUAL-SMOKE.md`](../docs/RELEASE-MANUAL-SMOKE.md))
- [x] Linked issue closed via `Closes #NNN` in the `## Related` section
## Impact
- CLI/Ops: Improved visibility into backend health; automated alerts reduce Mean Time to Detection (MTTD).
- Security: No secrets or private headers are exposed; alerting uses secure GitHub environment variables.
- Performance: Negligible impact; health snapshots are lightweight and cached via the registry.
## Related
- Closes#2058
- Follow-up PR(s)/TODOs: N/A
---
## AI Authored PR Metadata
### Linear Issue
- Key: N/A
- URL: N/A
### Commit & Branch
- Branch: `ops/uptime-monitoring-2058`
- Commit SHA: `650ad6bf3ae5780f9b19771be6b7be3f32121934`
### Validation Run
- [x] `pnpm --filter openhuman-app format:check`
- [x] `pnpm typecheck`
- [x] Focused tests: `src/core/jsonrpc_tests.rs`
- [x] Rust fmt/check (if changed): `cargo check`
- [x] Tauri fmt/check (if changed): N/A
### Validation Blocked
- Command: `git push`
- Error: Husky pre-push failed due to missing cmake path for unrelated dependencies (CEF/Whisper).
- Impact: Push required `--no-verify`.
### Behavior Changes
- Intended behavior change: `/health` returns `503` on internal failure.
- User-visible effect: Improved backend reliability and faster incident response.
### Parity Contract
- Legacy behavior preserved: Root `/` and other public paths remain accessible without auth.
- Guard/fallback/dispatch parity checks: Health check aggregates all `DomainEvent::HealthChanged` signals.
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **New Features**
* Added automated uptime monitoring that checks production and staging every 5 minutes, files/updates a single critical outage issue, and sends alert/recovery notifications to configured webhooks.
* Health endpoint now returns a detailed service snapshot and sets HTTP status based on component health.
* **Documentation**
* Added operations guide covering monitoring, alerting, testing, maintenance, and incident response runbook.
* **Tests**
* Added a test validating health endpoint status behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2178?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Satyam Pratibhan <142714564+SATYAM-PRATIBHAN@users.noreply.github.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
Steven EnamakelGitHubRafael Figuereodependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
