fix: allow the cursorvm.com box gateway family and add a changeset

Author: ScriptedAlchemy

.changeset/gateway-url-allowlist.md

@@ -0,0 +1,5 @@
+---
+"grok-bot-cli": patch
+---
+
+Send the gateway and EnsureSandBox bearer tokens only to `https` hosts on `*.cursor.sh`, `*.cursor.com`, or `*.cursorvm.com` (the box gateway family EnsureSandBox returns); refuse cross-origin fetch redirects; redact credential-shaped values from error output. `GROK_BOT_ALLOW_LOCAL_GATEWAY=1` admits loopback gateways and `GROK_BOT_ALLOW_ANY_GATEWAY=1` disables the host check.

README.md

@@ -39,7 +39,7 @@ Run `gbot --help` for every command.
 
 ## Gateway URL policy
 
-By default `gbot` only sends credentials to `https` URLs on `*.cursor.sh` / `*.cursor.com`.
+By default `gbot` only sends credentials to `https` URLs on `*.cursor.sh` / `*.cursor.com` / `*.cursorvm.com` (the box gateway family EnsureSandBox returns).
 
 - `GROK_BOT_ALLOW_LOCAL_GATEWAY=1` — permit `http(s)://127.0.0.1`, `localhost`, and `::1` (local/dev gateways).
 - `GROK_BOT_ALLOW_ANY_GATEWAY=1` — disable host checks (unsafe; for break-glass only).

src/url-policy.js

@@ -1,7 +1,9 @@
 /**
  * Gateway / backend URL policy: only send credentials to expected hosts.
  *
- * Default: https + *.cursor.sh / *.cursor.com (and apex).
+ * Default: https + *.cursor.sh / *.cursor.com (and apex) / *.cursorvm.com, the
+ * host family EnsureSandBox hands out for the box gateway (e.g.
+ * <id>-pod-<id>.us12.cursorvm.com).
  * Local/dev: http(s)://127.0.0.1|localhost|::1 when GROK_BOT_ALLOW_LOCAL_GATEWAY=1.
  * Escape hatch: GROK_BOT_ALLOW_ANY_GATEWAY=1 (unsafe; disables host checks).
  */
@@ -28,7 +30,7 @@ function isCursorHostname(hostname) {
   const h = String(hostname || "").toLowerCase();
   if (!h) return false;
   if (h === "cursor.sh" || h === "cursor.com") return true;
-  return h.endsWith(".cursor.sh") || h.endsWith(".cursor.com");
+  return h.endsWith(".cursor.sh") || h.endsWith(".cursor.com") || h.endsWith(".cursorvm.com");
 }
 
 /**
@@ -85,7 +87,7 @@ export function assertAllowedCredentialUrl(rawUrl, opts = {}) {
         label +
         " host \"" +
         host +
-        "\". Expected *.cursor.sh / *.cursor.com, or set GROK_BOT_ALLOW_LOCAL_GATEWAY=1 / GROK_BOT_ALLOW_ANY_GATEWAY=1.",
+        "\". Expected *.cursor.sh / *.cursor.com / *.cursorvm.com, or set GROK_BOT_ALLOW_LOCAL_GATEWAY=1 / GROK_BOT_ALLOW_ANY_GATEWAY=1.",
     );
   }
 

test/url-policy.test.js

@@ -37,6 +37,12 @@ test("allows https cursor.sh gateway hosts", () => {
       assertAllowedCredentialUrl("https://agent.cursor.com"),
       "https://agent.cursor.com",
     );
+    // The box gateway EnsureSandBox hands out lives on this family.
+    assert.equal(
+      assertAllowedCredentialUrl("https://145d7c6d03c7434e75f0-pod-abc-1340.us12.cursorvm.com/"),
+      "https://145d7c6d03c7434e75f0-pod-abc-1340.us12.cursorvm.com",
+    );
+    assert.throws(() => assertAllowedCredentialUrl("https://cursorvm.com.evil.example"), /Rejected gateway URL host/i);
   });
 });