85c0b9a3dc3795bf33646ef128ad070181c7abec
Reject requests from unrecognised Host headers when running authenticated/private. Adds server middleware, CLI `allowed-hostname` command, config-schema field, and prompt support for configuring allowed hostnames during onboard/configure. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Description
Languages
TypeScript
96.8%
Shell
1.7%
JavaScript
1%
CSS
0.3%
HTML
0.2%