hub: follow-ups for hub security, the extension and the native overlays #371

Items still open from the audit issues #354, #356 and #357. The fixed items landed in #364; this issue tracks what is left. Each item says why it was not part of that fix.

From #354 (hub security and redaction)

Partly done (the rest is open):

• Medium: No remote access in the Vite plugin: The explicit opt-in already exists as allowLan (needs auth plus a listed origin), so no new option was added. The 403 for a non-loopback peer now says how to allow it (set allowLan: true and list the origin). Test in vite-lan.test.ts; security.md and getting-started/vite.md updated.
• Low: Secret-name gaps and over-matches: Added signature, sig, salt, nonce, privkey, dsn and sid, plus card and cc pairs (cardNumber, ccExp, cardCvc, creditCard and others), mfaCode and recoveryCode/Key. card and cc count as secret words anywhere in a key, except before a short list of harmless words, so cardTitle, cardId and ccList stay readable. Left out auth alone (existing tests keep authStatus and auth slices readable on purpose), refresh (refreshInterval false positives; refresh tokens already match via token) and bare mfa/recovery (pair forms used instead). Tests added.
• Improvement: one redaction module plus a leak-corpus test across every collector: The shared text-redact.ts now serves serialize, the router and NgRx, and a corpus test covers those helpers. Merging the remaining modules (http-redact, json-text-redact, analog-redact, forms-privacy redactMessage) touches many files and is left for a follow-up.
• Improvement: log refused requests by peer and Host, and a security status endpoint: fix: phase 1 security for the hub, agent tools, pages and the extension #375 logs refused origins and hosts (hub-gate.ts). The security status endpoint is still open: it is new public API.

Open:

• Low: Any loopback port is trusted: Needs a product decision: the dev server's own origins aren't known in all setups (Analog, devtools:dev on 5173, SSR on 4000), and treating other loopback ports as remote would change the default access model, which overlaps phase 1 of 4: safe by default and wired into your workflow #340.
• Improvement: opt-in mask for high-entropy strings: Adds a new config option and public API; needs a design decision.
• Improvement: redaction counts in the panel and agent responses: Cross-cutting change to the panel and response shapes; needs a design decision.
• Improvement: pangular token --rotate CLI command: A new CLI command is new public API (product decision).

From #356 (Chrome extension)

Partly done (the rest is open):

• Medium: Only one trusted extension ID (Edge ID, PINNED_ORIGIN from same list): No Edge listing or ID exists yet, so none was added. extension/panel-bridge.js now uses a PINNED_ORIGINS list. The bridge is plain unbuilt JS, so it can't import the list. Instead a new test fails if PINNED_ORIGINS stops matching PANGULAR_EXTENSION_ORIGINS, and comments on both sides point at each other.
• Low: Worker tab map is lost when Chrome stops the worker: Removed the stray return true after the synchronous sendResponse in extension/background.js. fix: phase 1 security for the hub, agent tools, pages and the extension #375 then removed the service worker and its tab map altogether, so there is nothing left to lose.

Open:

• Low: Angular inside iframes is never found: Needs frame discovery and frameURL handling across detection, the page id lookup, $0 lookups and server origin choice. That is a larger design change, not a local fix.
• Low: Granted hosts cannot be seen or removed: Needs a new options page or status-view UI, which is a product and design decision.
• Low: Extension version is bumped by hand: The docs (contributing/publishing.md) say the extension keeps its own version separate from the npm package version. Syncing the two is a product decision.
• Low: No end-to-end test loads the real extension: Needs a new Playwright CI job with Chromium and the SSR demo app. Too large for this batch.
• Improvement: Toolbar icon with popup: New feature with new files and a manifest change; needs a design decision.
• Improvement: Elements sidebar pane: New feature, not small or local.
• Improvement: Keep the UI iframe across navigations: Changes reload behaviour and the panel's state handling; needs a decision on when to keep the iframe.
• Improvement: Remember the last working base path per origin: The probes now finish in about one round trip, so the gain may be too small to justify the extra state. Needs a decision.
• Improvement: Standalone mode without a server: Large feature across the extension and app; needs a product decision.
• Improvement: Audit the extension panel with axe: Needs changes to the axe harness, a chrome stub and the test:axe wiring; larger than a local fix.
• Improvement: CI release job for extension:zip: New CI workflow and release process; needs a decision.

From #357 (NativeScript and Angular Native overlays)

Partly done (the rest is open):

• Improvement: headless test harness per mobile overlay: No shared harness was built. A new overlay-nativescript-connection.test.ts feeds a fake view tree and checks the pushed report (platform, page id, trust, highlight).

Open:

• Low: Angular Native leaves the injector profiler ungated: This needs a new public export, prepareAngularNativeOverlay(), with its own call-order contract, and React Native normally defines window already, so the impact could not be confirmed in code.
• Low: CLI start-up names only Angular Native: Needs a label/product decision. ?view=angular-native shows only Angular Native apps, so a generic 'Mobile apps' line would point at the wrong view, and the NativeScript view is a setup card.
• Improvement: tap-to-pick on the device: New feature across two overlays plus panel behaviour; needs design.
• Improvement: record change detection on native apps: Larger cd-recorder change across both overlays; needs design.
• Improvement: highlight via an overlay native view: Larger platform-specific rendering change; needs design.