fix(security): isolate tenant execution and outbound egress

.env.example

@@ -22,6 +22,16 @@ REDIS_URL=
 # NODE_ENV=production
 # CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY=
 
+# Host outbound network policy
+# Remote modules and remote MCP calls may reach public HTTP(S) endpoints. The
+# runtime rejects loopback, private, link-local, metadata, and other non-global
+# destinations, including after DNS resolution and on every redirect hop.
+#
+# Emergency compatibility override. This disables that host SSRF ceiling and
+# must remain unset in shared runtimes. Project environment overlays cannot set
+# this host-owned option.
+# VERYFRONT_HOST_ALLOW_INTERNAL_EGRESS=1
+
 # Binary compilation
 # Set to 1 to always rebuild binary, even if source unchanged
 VERYFRONT_BINARY_FRESH=1

cli/commands/eval/command.ts

@@ -1172,6 +1172,8 @@ export async function runEvalCommand(
       fsAdapter: adapter.fs,
       cacheKey: configCacheKey,
       verbose: options.debug,
+      // The CLI executes source from the operator-selected local project.
+      allowHostProjectCodeExecution: true,
     });
     const evals = getDiscoveredEvals(projectRuntime);
 

cli/commands/schedule/handler.test.ts

@@ -31,6 +31,7 @@ const originalEnvironment = Object.fromEntries(
 const projectId = "22222222-2222-4222-8222-222222222222";
 const scheduleId = "33333333-3333-4333-8333-333333333333";
 const runId = "run_11111111-1111-4111-8111-111111111111";
+const TEST_PUBLIC_API_ORIGIN = "https://93.184.216.34";
 
 class ExitSentinel extends Error {
   constructor(readonly code: number) {
@@ -165,7 +166,7 @@ describe("schedule command", () => {
       await Deno.writeTextFile(
         `${projectDir}/veryfront.json`,
         JSON.stringify({
-          apiUrl: "https://api.from-config.test",
+          apiUrl: TEST_PUBLIC_API_ORIGIN,
           apiToken: "config-token",
           projectSlug: "json-only-project",
         }) + "\n",
@@ -216,9 +217,9 @@ describe("schedule command", () => {
 
       assertEquals(exitCode, 0);
       assertEquals(requests.map((request) => request.url), [
-        "https://api.from-config.test/projects/json-only-project/schedules?status=active&source_trigger_id=process-job-submissions",
-        `https://api.from-config.test/projects/json-only-project/schedules/${scheduleId}/runs`,
-        `https://api.from-config.test/runs/${encodeURIComponent(runId)}`,
+        `${TEST_PUBLIC_API_ORIGIN}/projects/json-only-project/schedules?status=active&source_trigger_id=process-job-submissions`,
+        `${TEST_PUBLIC_API_ORIGIN}/projects/json-only-project/schedules/${scheduleId}/runs`,
+        `${TEST_PUBLIC_API_ORIGIN}/runs/${encodeURIComponent(runId)}`,
       ]);
       assertEquals(
         requests.map((request) => new Headers(request.init?.headers).get("Authorization")),

cli/commands/schedule/handler.ts

@@ -56,7 +56,12 @@ function formatSchedule(schedule: ScheduleDefinition): string {
 async function handleScheduleList(_args: ParsedArgs): Promise<void> {
   const projectDir = Deno.cwd();
   await withProjectSourceContext(projectDir, async ({ adapter, config }) => {
-    const result = await discoverSchedules({ projectDir, adapter, config });
+    const result = await discoverSchedules({
+      projectDir,
+      adapter,
+      config,
+      allowHostProjectCodeExecution: true,
+    });
     await outputTriggerList({
       command: "schedules",
       items: result.items,
@@ -205,7 +210,12 @@ export async function handleScheduleCommand(args: ParsedArgs): Promise<void> {
   await withProjectSourceContext(projectDir, async (context) => {
     const { adapter, config, configCacheKey, projectId } = context;
     const input = opts.input ? await readJsonFile(opts.input, "--input JSON file") : undefined;
-    const result = await discoverSchedules({ projectDir, adapter, config });
+    const result = await discoverSchedules({
+      projectDir,
+      adapter,
+      config,
+      allowHostProjectCodeExecution: true,
+    });
     if (result.errors.length > 0) {
       throw DEPLOYMENT_ERROR.create({
         detail: `Schedule discovery failed: ${result.errors[0]?.message}`,

cli/commands/schedules/handler.ts

@@ -10,7 +10,12 @@ function formatSchedule(schedule: ScheduleDefinition): string {
 export async function handleSchedulesCommand(_args: ParsedArgs): Promise<void> {
   const projectDir = Deno.cwd();
   await withProjectSourceContext(projectDir, async ({ adapter, config }) => {
-    const result = await discoverSchedules({ projectDir, adapter, config });
+    const result = await discoverSchedules({
+      projectDir,
+      adapter,
+      config,
+      allowHostProjectCodeExecution: true,
+    });
     await outputTriggerList({
       command: "schedules",
       items: result.items,

cli/commands/task/command.ts

@@ -64,6 +64,7 @@ export async function taskCommand(options: TaskOptions): Promise<void> {
         fsAdapter: adapter.fs,
         cacheKey: configCacheKey,
         debug: options.debug,
+        allowHostProjectCodeExecution: true,
       });
       logRuntimeDiscoveryWarnings(discovery.errors, options.debug);
 

cli/commands/webhook/handler.ts

@@ -36,7 +36,12 @@ function formatWebhook(webhook: WebhookDefinition): string {
 async function handleWebhookList(_args: ParsedArgs): Promise<void> {
   const projectDir = Deno.cwd();
   await withProjectSourceContext(projectDir, async ({ adapter, config }) => {
-    const result = await discoverWebhooks({ projectDir, adapter, config });
+    const result = await discoverWebhooks({
+      projectDir,
+      adapter,
+      config,
+      allowHostProjectCodeExecution: true,
+    });
     await outputTriggerList({
       command: "webhooks",
       items: result.items,
@@ -68,7 +73,12 @@ export async function handleWebhookCommand(args: ParsedArgs): Promise<void> {
 
   await withProjectSourceContext(projectDir, async (context) => {
     const { adapter, config, configCacheKey, projectId } = context;
-    const result = await discoverWebhooks({ projectDir, adapter, config });
+    const result = await discoverWebhooks({
+      projectDir,
+      adapter,
+      config,
+      allowHostProjectCodeExecution: true,
+    });
     if (result.errors.length > 0) {
       throw new Error(`Webhook discovery failed: ${result.errors[0]?.message}`);
     }

cli/commands/webhooks/handler.ts

@@ -10,7 +10,12 @@ function formatWebhook(webhook: WebhookDefinition): string {
 export async function handleWebhooksCommand(_args: ParsedArgs): Promise<void> {
   const projectDir = Deno.cwd();
   await withProjectSourceContext(projectDir, async ({ adapter, config }) => {
-    const result = await discoverWebhooks({ projectDir, adapter, config });
+    const result = await discoverWebhooks({
+      projectDir,
+      adapter,
+      config,
+      allowHostProjectCodeExecution: true,
+    });
     await outputTriggerList({
       command: "webhooks",
       items: result.items,

deno.json

@@ -493,7 +493,7 @@
     "docs": "deno run --allow-read --allow-write --allow-run --allow-env scripts/docs/generate-api-reference.ts",
     "docs:coverage": "deno run --allow-read scripts/docs/docs-coverage.ts",
     "docs:copy": "rm -rf ../../docs/docs/code/api-reference && cp -r docs/api-reference/ ../../docs/docs/code/api-reference/",
-    "docs:validate": "deno run --allow-read scripts/docs/validate-api-reference.ts && deno run --allow-read scripts/docs/validate-guides.ts && deno run --allow-read scripts/docs/validate-public-docs.ts && deno test --config=scripts/test.deno.json --no-check --allow-read scripts/docs/docs-coverage.test.ts && deno test --no-check --allow-read tests/docs/guide-contracts.test.ts tests/docs/guide-content.test.ts && deno test --no-check --allow-all tests/docs/guide-examples.test.ts tests/docs/guide-code-examples.test.ts && deno run -A scripts/lint/check-doc-links.ts",
+    "docs:validate": "deno run --allow-read scripts/docs/validate-api-reference.ts && deno run --allow-read scripts/docs/validate-guides.ts && deno run --allow-read scripts/docs/validate-public-docs.ts && deno test --config=scripts/test.deno.json --no-check --allow-read scripts/docs/docs-coverage.test.ts && deno test --no-check --allow-read tests/docs/guide-contracts.test.ts tests/docs/guide-content.test.ts && DENO_TESTING=1 deno test --no-check --allow-all tests/docs/guide-examples.test.ts tests/docs/guide-code-examples.test.ts && deno run -A scripts/lint/check-doc-links.ts",
     "docs:verify-npm": "node scripts/docs/verify-npm-exports.mjs && node scripts/docs/verify-npm-node.mjs",
     "docs:check-links": "deno run -A scripts/lint/check-doc-links.ts",
     "lint:ban-zod": "deno run --allow-read scripts/lint/ban-zod-imports.ts",
@@ -528,7 +528,7 @@
     "test:all-runtimes": "deno task test:unit && deno task test:node && deno task test:bun",
     "test:e2e": "deno task test:e2e:playwright",
     "test:e2e:playwright": "PW_DISABLE_TS_ESM=1 npx playwright test --config=tests/e2e/playwright.config.cjs",
-    "test:e2e:rsc-browser": "deno task generate && VF_DISABLE_LRU_INTERVAL=1 SSR_TRANSFORM_PER_PROJECT_LIMIT=0 REVALIDATION_PER_PROJECT_LIMIT=0 NODE_ENV=production LOG_FORMAT=text deno test --no-check --allow-all tests/e2e/regressions/rsc-proxy-hydration.test.ts tests/e2e/regressions/2026-07-27-legacy-router-hydration.test.ts tests/e2e/regressions/2026-07-27-release-asset-page-island-hydration.test.ts --unstable-worker-options --unstable-net",
+    "test:e2e:rsc-browser": "deno task generate && DENO_TESTING=1 VF_DISABLE_LRU_INTERVAL=1 SSR_TRANSFORM_PER_PROJECT_LIMIT=0 REVALIDATION_PER_PROJECT_LIMIT=0 NODE_ENV=production LOG_FORMAT=text deno test --no-check --allow-all tests/e2e/regressions/rsc-proxy-hydration.test.ts tests/e2e/regressions/2026-07-27-legacy-router-hydration.test.ts tests/e2e/regressions/2026-07-27-release-asset-page-island-hydration.test.ts --unstable-worker-options --unstable-net",
     "test:e2e:binary": "deno task generate && deno test --allow-all tests/integration/compiled-binary-e2e.test.ts",
     "test:e2e:binary:fresh": "deno task generate && VERYFRONT_BINARY_FRESH=1 deno test --allow-all tests/integration/compiled-binary-e2e.test.ts",
     "test:e2e:templates": "deno run --allow-all scripts/test/template-runtime-e2e.ts",

scripts/lint/test-typecheck-baseline.json

@@ -50,11 +50,9 @@
   "src/rendering/orchestrator/config.test.ts",
   "src/rendering/utils/react-helpers.test.ts",
   "src/resource/registry.test.ts",
-  "src/routing/api/module-loader/security-config.test.ts",
   "src/routing/api/openapi/mcp-resource.test.ts",
   "src/runs/schemas.test.ts",
   "src/server/build-service-worker.test.ts",
-  "src/server/handlers/response/cors.test.ts",
   "src/transforms/import-rewriter/strategies/import-map-strategy.test.ts",
   "src/transforms/md/compiler/md-compiler.test.ts",
   "src/transforms/mdx/compiler/index.test.ts",

scripts/test/coverage-ci.ts

@@ -17,6 +17,7 @@ interface LcovLineRecord {
 
 const UNIT_COVERAGE_ROOTS = ["src", "cli"];
 const UNIT_COVERAGE_ENV = {
+  DENO_TESTING: "1",
   VF_DISABLE_LRU_INTERVAL: "1",
   SSR_TRANSFORM_PER_PROJECT_LIMIT: "0",
   REVALIDATION_PER_PROJECT_LIMIT: "0",

src/agent/ag-ui/detached-start.test.ts

@@ -282,10 +282,20 @@ describe("agent/ag-ui-detached-start", () => {
     const response = await executeAgUiDetachedStart(
       {
         sessionManager,
-        context: { tenant: "acme" },
-        startDetachedExecution: async ({ request, context }) => {
+        context: (request) => {
+          assertEquals(request.headers.get("authorization"), "Bearer public-user");
+          assertEquals(request.headers.get("cookie"), "session=public");
+          assertEquals(request.headers.get("x-token"), null);
+          assertEquals(request.headers.get("x-project-id"), null);
+          return { tenant: "acme" };
+        },
+        startDetachedExecution: async ({ request, context, rawRequest, requestOrCtx }) => {
           assertEquals(request.runId, "run_1");
           assertEquals(context, { tenant: "acme" });
+          assertEquals(rawRequest.headers.get("authorization"), "Bearer public-user");
+          assertEquals(rawRequest.headers.get("x-forwarded-host"), null);
+          assertEquals(rawRequest.headers.get("x-veryfront-control-plane-jws"), null);
+          assertEquals(requestOrCtx, rawRequest);
         },
         onAccepted: ({ runId }) => {
           acceptedRunId = runId;
@@ -306,7 +316,15 @@ describe("agent/ag-ui-detached-start", () => {
         }),
         rawRequest: new Request("http://localhost/api/runs", {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: "Bearer public-user",
+            Cookie: "session=public",
+            "x-token": "host-secret",
+            "x-project-id": "infrastructure-project",
+            "x-forwarded-host": "trusted-proxy.example",
+            "x-veryfront-control-plane-jws": "signed-infrastructure-token",
+          },
         }),
       },
     );

src/agent/ag-ui/detached-start.ts

@@ -17,6 +17,7 @@ import {
 } from "../runtime/index.ts";
 import type { Agent } from "../types.ts";
 import type { ChatUiMessage, MessageMetadata } from "#veryfront/chat/types.ts";
+import { createApplicationRequest } from "#veryfront/security/http/application-request.ts";
 
 const AGENT_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
 const getAgUiDetachedRunIdSchema = defineSchema((v) =>
@@ -302,7 +303,11 @@ export async function executeAgUiDetachedStart(
   input: ExecuteAgUiDetachedStartInput,
 ): Promise<Response> {
   const rawRequest = assertDetachedStartRawRequest(options, input);
-  const context = await resolveDetachedStartContext(options, input);
+  const applicationRequest = rawRequest ? createApplicationRequest(rawRequest) : undefined;
+  const context = await resolveDetachedStartContext(options, {
+    ...input,
+    rawRequest: applicationRequest,
+  });
 
   try {
     const abortSignal = options.sessionManager.startRun({
@@ -321,8 +326,8 @@ export async function executeAgUiDetachedStart(
         if (options.startDetachedExecution) {
           await options.startDetachedExecution({
             request: input.request,
-            requestOrCtx: input.requestOrCtx,
-            rawRequest: rawRequest!,
+            requestOrCtx: applicationRequest,
+            rawRequest: applicationRequest!,
             context,
             abortSignal,
           });
@@ -410,9 +415,12 @@ export function createAgUiDetachedStartHandler(
 
   return async function POST(requestOrCtx: unknown): Promise<Response> {
     const request = extractRequest(requestOrCtx);
+    const applicationRequest = createApplicationRequest(request);
 
     try {
-      const parsed = getAgUiDetachedStartRequestSchema().parse(await parseAgUiJsonBody(request));
+      const parsed = getAgUiDetachedStartRequestSchema().parse(
+        await parseAgUiJsonBody(applicationRequest),
+      );
       return await executeAgUiDetachedStart(options, {
         request: parsed,
         rawRequest: request,

src/agent/ag-ui/handler.test.ts

@@ -433,23 +433,42 @@ describe("agent/ag-ui-handler", () => {
     const testAgent = createTestAgent();
     const handler = createAgUiHandler({
       agent: testAgent.agent,
-      context: { tenant: "acme" },
-      beforeStream: ({ lastUserText, context }) => ({
-        prepend: [{
-          role: "user",
-          parts: [{
-            type: "text",
-            text: `Retrieved context for: ${lastUserText}`,
+      context: (request) => {
+        assertEquals(request.headers.get("authorization"), "Bearer public-user");
+        assertEquals(request.headers.get("cookie"), "session=public");
+        assertEquals(request.headers.get("x-token"), null);
+        assertEquals(request.headers.get("x-project-id"), null);
+        return { tenant: "acme" };
+      },
+      beforeStream: ({ request, lastUserText, context }) => {
+        assertEquals(request.headers.get("authorization"), "Bearer public-user");
+        assertEquals(request.headers.get("x-forwarded-host"), null);
+        assertEquals(request.headers.get("x-veryfront-dispatch-jws"), null);
+        return {
+          prepend: [{
+            role: "user",
+            parts: [{
+              type: "text",
+              text: `Retrieved context for: ${lastUserText}`,
+            }],
           }],
-        }],
-        context: { ...context, retrieval: "complete" },
-      }),
+          context: { ...context, retrieval: "complete" },
+        };
+      },
     });
 
     const response = await handler(
       new Request("http://localhost/api/ag-ui", {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: "Bearer public-user",
+          Cookie: "session=public",
+          "x-token": "host-secret",
+          "x-project-id": "infrastructure-project",
+          "x-forwarded-host": "trusted-proxy.example",
+          "x-veryfront-dispatch-jws": "signed-infrastructure-token",
+        },
         body: JSON.stringify({
           messages: [{
             id: "msg-1",

src/agent/ag-ui/handler.ts

@@ -31,6 +31,7 @@ import {
 } from "./host-support.ts";
 import { extractRequest } from "./request-shared.ts";
 import { type AgUiResumeValue, buildMergedAgUiTools } from "./tool-shared.ts";
+import { createApplicationRequest } from "#veryfront/security/http/application-request.ts";
 
 export {
   type AgUiContextItem,
@@ -523,6 +524,7 @@ export function createAgUiHandler(
 ) {
   return async function POST(requestOrCtx: unknown): Promise<Response> {
     const request = extractRequest(requestOrCtx);
+    const applicationRequest = createApplicationRequest(request);
 
     let agent: Agent | undefined;
 
@@ -548,7 +550,7 @@ export function createAgUiHandler(
     }
 
     try {
-      const parsed = await parseAgUiRequestOrError(request);
+      const parsed = await parseAgUiRequestOrError(applicationRequest);
       if (isResponseLike(parsed)) {
         return parsed;
       }
@@ -565,13 +567,13 @@ export function createAgUiHandler(
         }
 
         const context = typeof options?.context === "function"
-          ? await options.context(request)
+          ? await options.context(applicationRequest)
           : options?.context ?? {};
 
         return await createAgUiInjectedToolsStreamResponse(
           agent,
           parsed,
-          request,
+          applicationRequest,
           context,
           options.sessionManager,
           options?.beforeStream,
@@ -580,13 +582,13 @@ export function createAgUiHandler(
       }
 
       const context = typeof options?.context === "function"
-        ? await options.context(request)
+        ? await options.context(applicationRequest)
         : options?.context ?? {};
 
       return await createAgUiDirectStreamResponse(
         agent,
         parsed,
-        request,
+        applicationRequest,
         context,
         options?.beforeStream,
         options?.onComplete,