Require explicit acknowledgement for plaintext remote Brainstorm binds

[avzamelek]

Who is submitting this PR? (required)

Field	Value
Your model + version	Branch authoring: Anthropic Claude Fable 5 (claude-fable-5)
Harness + version	Branch authoring: Claude Code 2.1.216–2.1.218. Stack preparation/submission: Codex Desktop 0.146.0-alpha.3.1.
All plugins installed	Claude Code authoring environment: cloud-build, decision-log, elements-of-style, episodic-memory, greenfield, iterative-development, linear, primeradiant-ops, superpowers-chrome, superpowers (local dev), unifi-network. Codex submission environment: documents, pdf, spreadsheets, presentations, template-creator, sites, browser, computer-use, visualize, primeradiant-ops, linear, slack, github, codex-security, superpowers (local dev), cloud-build.
Human partner who reviewed this diff	Avza

What problem are you trying to solve?

In a remote/containerized Brainstorm Companion session, I needed to bind the
server with --host 0.0.0.0 so that a browser outside the execution
environment could access it.

The companion serves HTTP only and returns a URL containing
?key=<session-token>. This token is a bearer credential accepted by both the
HTTP endpoints and WebSocket upgrade path. If a non-loopback listener is
exposed over an untrusted network without encrypted transport, an observer can
capture and replay the token to read companion screens and files or submit
WebSocket events that are persisted to state/events.

The previous launcher made a plaintext non-loopback bind easy to select without
requiring the operator to explicitly acknowledge that transport boundary.

What does this PR change?

• Reject non-loopback HTTP binds unless the operator explicitly passes
  --insecure-remote.
• Document SSH local port forwarding as the default remote/container access
  pattern.
• Document that direct non-loopback use requires a TLS-terminating reverse
  proxy or another trusted encrypted transport.
• Add regression coverage for both the default rejection and explicit opt-in
  behavior.

Is this change appropriate for the core library?

Yes. This changes the shared Brainstorm Companion launch path and protects all
users who run the companion outside a loopback-only environment. It is not
project-, harness-, or vendor-specific.

What alternatives did you consider?

Adding TLS directly to the zero-dependency companion server would require
certificate and private-key configuration, as well as a broader deployment and
support model. Keeping loopback as the secure default and recommending SSH port
forwarding preserves the existing architecture. The explicit
--insecure-remote escape hatch preserves deployments that already provide TLS
termination or an equivalent trusted transport.

Does this PR contain multiple unrelated changes?

No. The launcher guard, remote-access documentation, and regression tests are
one cohesive security change: preventing accidental plaintext non-loopback
exposure of a bearer-authenticated companion.

Existing PRs

• I have reviewed all open AND closed PRs for duplicates or prior art
• Related PRs: none found

Environment tested

Harness	Harness version	Model	Model version/ID
Claude Desktop	Not exposed in session	Claude Fable 5 Ultracode	Claude Fable 5 Ultracode

Validation run:

text
npm test
git diff --check

New harness support

Not applicable. This PR does not add or modify support for any harness.

Evaluation

Item	Result
Initial prompt	Investigate the security implications of running the Brainstorm Companion remotely with --host 0.0.0.0.
Post-change eval sessions	Not applicable. This change affects launcher infrastructure, not behavior-shaping skill content.
Before	A non-loopback plaintext HTTP bind could start without an explicit operator acknowledgement.
After	A non-loopback bind fails closed unless --insecure-remote is explicitly supplied.

Rigor

Check	Status
Skill-content change	Not applicable — no skill-content behavior was modified.
Adversarial coverage	Passed — regression coverage verifies rejection without acknowledgement and success with explicit opt-in.
Tuned skill wording	Unchanged.

Human review

• A human has reviewed the COMPLETE proposed diff before submission.