Security: restore Jupyter origin and XSRF protection

SECURITY.md

@@ -34,7 +34,7 @@ development branch until versioned release support is documented.
 - Treat `HTTP_LISTEN=0.0.0.0:7410` as an internal daemon API. Startup emits a
   warning but still proceeds; use container networking, reverse proxies, VPNs,
   or equivalent controls to avoid direct public access.
-- Do not expose guest Jupyter ports directly. Use the agent-compose proxy.
+- Do not expose guest Jupyter ports directly. Use the agent-compose proxy; the guest keeps same-origin and XSRF protection enabled.
 - Treat workspace uploads, Git credentials, environment variables, webhook
   tokens, and LLM API keys as secrets.
 - Review runtime driver network behavior before running untrusted workloads.

pkg/driver/jupyter_guest.go

@@ -180,7 +180,7 @@ func jupyterLaunchCommandWithBootstrap(config *appconfig.Config, proxyState Prox
 		" --ServerApp.root_dir=\"" + config.GuestWorkspacePath + "\"" +
 		" --ServerApp.base_url=\"" + strings.TrimRight(jupyterBaseURL(proxyState), "/") + "\"" +
 		" --IdentityProvider.token=\"" + proxyState.Token + "\"" +
-		" --ServerApp.password= --ServerApp.allow_origin='*' --ServerApp.disable_check_xsrf=True" +
+		" --ServerApp.password= --ServerApp.allow_origin='' --ServerApp.disable_check_xsrf=False" +
 		" --allow-root --no-browser"
 	if background {
 		// Keep the trailing ampersand scoped to the Jupyter launch. Without

pkg/driver/runtime_mount_manifest_test.go

@@ -671,6 +671,12 @@ func TestBackgroundJupyterLaunchCommandStartsBeforeJupyterLabImportProbe(t *test
 	}
 
 	backgroundCommand := jupyterLaunchCommand(config, proxyState, true)
+	if strings.Contains(backgroundCommand, "--ServerApp.allow_origin='*'") || strings.Contains(backgroundCommand, "--ServerApp.disable_check_xsrf=True") {
+		t.Fatalf("jupyter command weakens origin or xsrf protection: %s", backgroundCommand)
+	}
+	if !strings.Contains(backgroundCommand, "--ServerApp.allow_origin='' --ServerApp.disable_check_xsrf=False") {
+		t.Fatalf("jupyter command does not explicitly retain origin and xsrf protection: %s", backgroundCommand)
+	}
 	if strings.Contains(backgroundCommand, "python3 -c \"import jupyterlab;") {
 		t.Fatalf("background jupyter command should not block on import probe before nohup: %s", backgroundCommand)
 	}