fix(cli): refuse cross-origin redirects so credentials stay with the configured server

TR
13h ago
+250-3

Why

The generated CLI's HTTP client used the net/http default redirect policy. On a redirect to another host, net/http strips Authorization and Cookie but forwards every other header, so an API key sent in a custom header (for example x-api-key) reached the new host. On 307/308 the request body was replayed as well, and an https to http redirect would send the key in cleartext.

The default server URL is unlikely to redirect off-origin, so this mostly matters when --server-url points at a proxy, gateway or a mistyped host. Either way the CLI should never forward credentials to a server the user did not configure.

What changed

  • internal/client now sets CheckRedirect to SameOriginRedirect. Redirects that keep the scheme and host are still followed (up to 10). Anything else fails with an error naming both origins, for example refusing to follow a redirect from https://api.example.com to http://other.example.com: credentials are only sent to the configured server.
  • New internal/client/client_test.go covers a same-origin redirect and a cross-origin 307 using two local servers, and asserts the credential header never reaches the second server.
  • Review SDK regenerated; changeset added.

Testing

  • TARGET=review make test-cli: passes, including the new test.
  • make check-template-cli and make lint: pass.
  • TARGET=primary make test-cli: the redirect test passes; the suite's interactive configure form tests need to run outside an environment that triggers automatic agent mode.

Public-safety check

  • This change contains no credentials, customer documents, private repository URLs, private filesystem paths, or unredacted private logs.
  • Title, body, comments, and commit messages name no customers or customer-derived identifiers, private paths or trackers, or workflow provenance, and are understandable without private context (.claude/skills/public-repo-communication/SKILL.md).
  • Generated fixtures and review SDK changes are public-safe.
  • I reviewed git diff --check.

Summary by cubic

Fixes a credential leak in the generated CLI: net/http's default redirect policy forwards custom headers like an API key to the redirect target, which could be a different host or a scheme downgrade. The CLI now refuses redirects to a different scheme, host, or port, so credentials are only ever sent to the server the user configured; same-origin redirects still work (up to 10) and explicit default ports are treated as the same origin. A new test covers both behaviors and asserts the API key never reaches the second server.