fix(proxy): refuse what the proxy cannot read, and lock the approval UI

[CharmingGroot]

The proxy treated anything it could not read as "nothing to guard". A Responses API body, a compressed body, an unknown endpoint and a stream event it did not parse were all forwarded unchecked — and a default: deny policy let a shell call through. Separately, the approval UI took a form post from anything that could reach its port, including the agent it guards.

Each fix below was reproduced as a failing test against the old code first, run with the shipped deploy/rules.yaml, then mutation-checked: reverting the guard makes its test fail again.

The approval UI answers only to whoever started it

/decision and /egress/allow took unauthenticated form posts, and approval ids are sequential. The kernel layer always passes loopback, so an allowed shell tool could approve the agent's own pending Ask, or add an address to the kernel allowlist. Any web page the operator had open could do the same cross-site.

Every UI request now needs a token generated from the OS random source at startup. The printed URL carries it once; after that it lives in a SameSite=Strict, HttpOnly cookie, and a state change whose Origin names another host is refused.

Tool calls in every shape they arrive in

• OpenAI Responses API output[] items, streamed and not. Any *_call item the provider does not run itself counts as a tool call, including types newer than this code.
• The deprecated message.function_call, and Gemini streamGenerateContent answered as a JSON array.
• SSE is framed per the spec (CR/LF/CRLF, multi-line data: joined). An event that is not JSON, or argument fragments that belong to no named call, make the stream unreadable instead of silently shorter.
• OpenAI argument strings are re-serialized before the guard sees them, so escapes such as / cannot hide a path from a rule.

Forward only what it can guard

• WireFormat::route names each endpoint:
  • A completion's response must parse, or it is refused.
  • Token counting is screened.
  • Model listing passes.
  • Anything else is refused before it leaves, unless named with --passthrough-path.
  • The default route is the strict reading, so out-of-tree formats are covered.
• With an inspector on, a prompt that cannot be read is refused. Responses API prompts are now read.
• The upstream is asked for Accept-Encoding: identity, hop-by-hop headers are dropped, and a completion compressed anyway is refused.
• --max-request-bytes (32 MiB) and --max-response-bytes (64 MiB). The read timeout is idle-only, so an endless stream used to be buffered forever.
• Provider errors (4xx/5xx) are relayed with their status and headers.

Behaviour changes

• Endpoints the provider format does not name (embeddings, files, batches) are now refused. Name them with --passthrough-path to forward them uninspected.
• pasu_ui::router, serve and serve_all take an Access.

Verification

• cargo test, clippy -D warnings and fmt --check pass (portable crates).
• The binary was replayed against a mock provider. Results:
  • A Responses API shell call: 403.
  • /v1/embeddings: 403.
  • The upstream saw identity although the client asked for gzip.
  • 51 guessed unauthenticated approvals: 51× 401.
  • Cross-site post: 401.
  • Operator deny: 303, and the agent got a 403.

🤖 Generated with Claude Code