From c4268bd97c2c7bb388724529765cd3fe6684841d Mon Sep 17 00:00:00 2001
From: Mike Ilog <48659643+Mike-E-Log@users.noreply.github.com>
Date: Sun, 31 May 2026 15:45:51 -0700
Subject: [PATCH] fix(extension): withhold auth token from content-script
 getPort callers

The getPort message handler returned the localhost auth token to every
caller, including content scripts, while the sibling getToken handler
deliberately rejects content-script contexts (sender.tab is set for
content scripts). A content script injected into a page could therefore
obtain the token getToken is careful to protect.

Apply the same sender.tab guard to getPort: port and connected stay
available to any extension context, but the auth token is withheld from
content-script callers. Mirrors the existing getToken behavior; no other
behavior changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 extension/background.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/extension/background.js b/extension/background.js
index d0abe6328..3e28a396f 100644
--- a/extension/background.js
+++ b/extension/background.js
@@ -299,7 +299,13 @@ chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => {
   }
 
   if (msg.type === 'getPort') {
-    sendResponse({ port: serverPort, connected: isConnected, token: authToken });
+    // Withhold the auth token from content-script callers (content scripts have
+    // sender.tab set), mirroring the getToken guard below. port/connected stay
+    // available to any extension context, but the localhost auth token is never
+    // handed to an injected page context — without this guard getPort leaks the
+    // exact token getToken is careful to protect.
+    const token = sender.tab ? null : authToken;
+    sendResponse({ port: serverPort, connected: isConnected, token });
     return true;
   }