fix(web): validate desktop session callback port

[richiemcilroy]

What

The desktop sign-in callback (GET /api/desktop/session/request) accepted its port query parameter as an optional string and interpolated it directly into the callback URL. This constrains port to a numeric port (1-65535) and constructs the loopback callback URL through a fixed-host helper, so the callback target is always 127.0.0.1.

It also escapes the values rendered into the desktop fallback page's inline <script> block and its href attribute.

Why it is safe for the desktop app

The desktop app supplies port from its local OAuth callback server (plugin:oauth|start), which always returns a numeric loopback port, so it still passes validation. Behaviour for valid ports is unchanged; only a non-numeric port now returns 400 instead of redirecting. The no-port deep-link path and the platform/type defaults are untouched.

Changes

• apps/web/lib/desktop-session.ts (new): request schema, buildLoopbackCallbackUrl, and the fallback page renderer with output escaping.
• apps/web/app/api/desktop/[...route]/session.ts: use the shared schema and helper.
• apps/web/__tests__/unit/desktop-session-port.test.ts (new): 32 tests covering schema accept/reject, the loopback invariant across the full port range, the request boundary, and the fallback page escaping.

Testing

• pnpm --dir apps/web exec vitest run __tests__/unit/desktop-session-port.test.ts (32 passing)
• Typecheck and Biome format clean on the changed files.

Greptile Summary

The PR secures the desktop session callback against off-loopback redirects and fallback-page injection.

• Validates callback ports as integers in the range 1–65535.
• Builds callback URLs using a fixed 127.0.0.1 host.
• Safely serializes inline script state and escapes the fallback link attribute.
• Adds focused tests for validation, request-boundary behavior, loopback invariants, and output escaping.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified.

Valid desktop callback ports remain accepted, callback credentials remain constrained to the loopback host, and the extracted fallback-page renderer preserves behavior while eliminating its injection sinks.

Important Files Changed

Filename	Overview
apps/web/lib/desktop-session.ts	Introduces bounded port validation, fixed-host callback URL construction, and context-appropriate HTML/script escaping without an identified regression.
apps/web/app/api/desktop/[...route]/session.ts	Integrates the shared schema and URL/page helpers while preserving the existing valid-port, deep-link, and platform branches.
apps/web/tests/unit/desktop-session-port.test.ts	Adds comprehensive coverage for accepted and rejected ports, endpoint validation, loopback targeting, and fallback-page escaping.

_{Reviews (1): Last reviewed commit: "fix(web): validate desktop session callb..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Web App (apps/web)

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.