Found during v0.9.7 release review (Tech Lead persona), referencing the deliberate duplication called out in eb1124e (#1100)'s own commit message ('shared-helper refactor is a follow-up ticket once both flows have prod experience').
packages/opencode/src/altimate/workspace/browser-handoff.ts duplicates the loopback-listener pattern from altimate.ts's gateway sign-in flow. In the process, browser-handoff.ts added a DNS-rebinding Host-header guard that altimate.ts does NOT have (confirmed via git log v0.9.6..HEAD -- .../altimate.ts = empty, i.e. altimate.ts is unchanged this release).
Scope this refactor to:
- Extract a shared loopback-listener helper both flows call.
- Backport the Host-header DNS-rebinding check into altimate.ts's sign-in flow so it gets the same hardening.
Not urgent — both flows currently work correctly on their own, this is a maintainability/consistency cleanup.
Found during v0.9.7 release review (Tech Lead persona), referencing the deliberate duplication called out in eb1124e (#1100)'s own commit message ('shared-helper refactor is a follow-up ticket once both flows have prod experience').
packages/opencode/src/altimate/workspace/browser-handoff.tsduplicates the loopback-listener pattern fromaltimate.ts's gateway sign-in flow. In the process, browser-handoff.ts added a DNS-rebinding Host-header guard thataltimate.tsdoes NOT have (confirmed viagit log v0.9.6..HEAD -- .../altimate.ts= empty, i.e. altimate.ts is unchanged this release).Scope this refactor to:
Not urgent — both flows currently work correctly on their own, this is a maintainability/consistency cleanup.