fix(security): add CSRF protection, CORS whitelist, and security headers

[ycjcl868]

Summary

• CORS Origin Whitelist: Replace permissive origin: '*' with dynamic validation — only localhost:<port>, 127.0.0.1:<port>, and file:// are allowed. Supports TARKO_ALLOWED_ORIGINS env var for additional origins.
• CSRF Token Verification: All mutation requests (POST/PUT/DELETE) must carry a valid X-CSRF-Token header. Tokens are obtained via GET /api/v1/csrf-token, stored server-side with 24h expiry.
• Security Response Headers: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, X-XSS-Protection: 1; mode=block, Referrer-Policy: strict-origin-when-cross-origin.

Both server implementations are patched:

• Express (agent-server): middleware + route
• Hono (agent-server-next): hooks + route

Client (agent-ui) updated with mutationFetch() that auto-acquires CSRF tokens and retries on 403.

Files Changed (12)

File	Change
agent-server/src/api/index.ts	CORS whitelist + security headers middleware
agent-server/src/api/middleware/csrf-protection.ts	New — CSRF token generation & validation
agent-server/src/api/routes/csrf.ts	New — GET /api/v1/csrf-token endpoint
agent-server/src/api/middleware/index.ts	Export new middleware
agent-server/src/server.ts	Pass port to setupAPI()
agent-server-next/src/hooks/builtInHooks.ts	createCorsHook(port), createCsrfProtectionHook(), SecurityHeadersHook
agent-server-next/src/hooks/index.ts	Export new hooks
agent-server-next/src/routes/csrf.ts	New — CSRF token route for Hono
agent-server-next/src/routes/index.ts	Export CSRF routes
agent-server-next/src/server.ts	Register CSRF routes
agent-server-next/examples/bootstrap.ts	Use new secure hooks
agent-ui/src/common/services/apiService.ts	mutationFetch() with CSRF token auto-refresh

Test plan

• E2E test: 16/16 passed (CSRF block, CORS whitelist, security headers, combined attack simulation)
• Manual: start full server, verify UI can create sessions and send queries normally
• Manual: open browser devtools, confirm X-CSRF-Token header present on POST requests
• Manual: from a different origin page, confirm POST to localhost is blocked

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for agent-tars-docs ready!

Name	Link
🔨 Latest commit	e87619e
🔍 Latest deploy log	https://app.netlify.com/projects/agent-tars-docs/deploys/69c5e12ea3697b00082fad87
😎 Deploy Preview	https://deploy-preview-1853--agent-tars-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for tarko ready!

Name	Link
🔨 Latest commit	e87619e
🔍 Latest deploy log	https://app.netlify.com/projects/tarko/deploys/69c5e12e4d4e610008733533
😎 Deploy Preview	https://deploy-preview-1853--tarko.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.