Harden local trust boundary and fix signing-path bugs

[gskril]

Why

The proxy triggers wallet signing and exposes pending-transaction data, but it bound to all network interfaces with wildcard CORS and no Origin/Host validation. That means any website the developer visited — or any machine on the same LAN — could:

• inject an eth_sendTransaction that auto-opens a wallet-approval tab (a text/plain "simple" request skips the CORS preflight, so the side effect fires regardless),
• read the to/value/data of in-flight signing requests via the /api/pending enumeration endpoint, and
• forge a result back to Foundry/Hardhat via unauthenticated /api/complete.

This PR closes that boundary and fixes several correctness bugs in the signing path found during the same review.

What changed

Server — trust boundary

• Local-only guard (server.ts): rejects requests whose Host isn't loopback (localhost/127.0.0.1/[::1]:<port>, blocking DNS rebinding) or whose Origin is present and foreign (blocking CSRF). Non-browser tools send no Origin and pass through, so Foundry/Hardhat/curl keep working.
• Bind to 127.0.0.1 (index.ts) so the server is unreachable off-machine; also validates --port.
• Removed /api/pending enumeration (and dead getAllPendingIds/getPendingCount) — the unguessable UUID is now the only handle to a request.
• DoS caps: batch size ≤ 50, concurrent pending ≤ 100.
• /api/complete hardening: guarded JSON parse (clean 400, not 500) and a required boolean success.
• Timer cleanup on resolve + unref; unknown /api/* returns JSON 404 instead of the SPA page.

Web — signing path

• personal_sign/eth_sign sign raw bytes for hex messages ({ raw }) instead of the UTF-8 of the "0x…" string, so the signature verifies against what the dapp expects and the wallet popup matches the review screen.
• Always notify the server on failure (not just on "rejected"/"denied"), so the calling script gets an immediate rejection instead of hanging until the 5-minute timeout.
• Success-after-send: a failure reporting completion is logged, not shown to the user as a transaction error (prevents duplicate re-submits).
• Re-entrancy guard (useRef) so a double-click can't broadcast twice.

Verification

• bun run build (server + web) and tsc --noEmit both clean.
• Live smoke test against a running server: tool eth_chainId works; cross-origin eth_sendTransaction → 403; foreign Host → 403; /api/pending → 404 JSON (no ID leak); 51-item batch → 400; malformed/empty /api/complete → 400; valid routes + SPA still 200.

Notes for reviewers

• The guard treats a missing Origin as allowed on purpose — that's how non-browser dev tools reach the RPC. Browsers always send Origin on cross-origin POSTs, so the CSRF path is covered.
• Follow-ups from the review left out of this PR: supply-chain hardening (SHA-pin the publish workflow, bun install --frozen-lockfile, the ./types export pointing at unshipped source) and remaining web display-fidelity fixes (chain label vs tx.chainId, formatUnits decimals, generate-chains.ts currency coupling, an error boundary, surfacing nonce/fees).

🤖 Generated with Claude Code

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/browser-rpc@4

commit: 3cdf617