fix(*): harden local service boundaries (#2062)

services/minecraft/src/composables/config.ts

@@ -152,5 +152,12 @@ export function initEnv(): void {
   config.airi = parsedConfig.data.airi
   config.debug = parsedConfig.data.debug
 
-  logger.withFields({ config }).log('Environment variables initialized')
+  logger.withFields({
+    config: {
+      ...config,
+      openai: { ...config.openai, apiKey: '[REDACTED]' },
+      bot: { ...config.bot, password: '[REDACTED]' },
+      airi: { ...config.airi, token: '[REDACTED]' },
+    },
+  }).log('Environment variables initialized')
 }

services/minecraft/src/debug/mcp-repl-server.ts

@@ -254,17 +254,6 @@ export class McpReplServer {
 
     this.server = createServer(async (req, res) => {
       try {
-        res.setHeader('Access-Control-Allow-Origin', '*')
-        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS')
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, MCP-Session-Id, Last-Event-ID')
-        res.setHeader('Access-Control-Expose-Headers', 'MCP-Session-Id')
-
-        if (req.method === 'OPTIONS') {
-          res.statusCode = 204
-          res.end()
-          return
-        }
-
         const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`)
 
         if (req.method === 'GET' && url.pathname === '/') {
@@ -358,7 +347,7 @@ export class McpReplServer {
       }
     })
 
-    this.server.listen(this.port, () => {
+    this.server.listen(this.port, '127.0.0.1', () => {
       logger.log(`MCP REPL server running at http://localhost:${this.port}`)
     })
   }

services/minecraft/src/debug/server.ts

@@ -103,7 +103,7 @@ export class DebugServer {
       this.sendHeartbeat()
     }, this.HEARTBEAT_INTERVAL)
 
-    this.httpServer.listen(port, () => {
+    this.httpServer.listen(port, '127.0.0.1', () => {
       useLogger().log(`Debug server running at http://localhost:${port}`)
     })
   }

services/twitter-services/src/adapters/mcp-adapter.ts

@@ -424,23 +424,6 @@ export class MCPAdapter {
   private setupRoutes(): void {
     const router = createRouter()
 
-    // Set up CORS
-    router.use('*', defineEventHandler((event) => {
-      const node = event.node
-      if (!node?.res || !node.req) {
-        return
-      }
-
-      node.res.setHeader('Access-Control-Allow-Origin', '*')
-      node.res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
-      node.res.setHeader('Access-Control-Allow-Headers', 'Content-Type')
-
-      if (node.req.method === 'OPTIONS') {
-        node.res.statusCode = 204
-        node.res.end()
-      }
-    }))
-
     // SSE endpoint
     router.get('/sse', defineEventHandler(async (event) => {
       const node = event.node
@@ -561,7 +544,7 @@ export class MCPAdapter {
           })
         }
 
-        this.server.listen(this.port, () => {
+        this.server.listen(this.port, '127.0.0.1', () => {
           const serverAddress = `http://localhost:${this.port}`
           logger.mcp.log(`MCP server started at: ${serverAddress}`)
           logger.mcp.log(`SSE endpoint: ${serverAddress}/sse`)

services/twitter-services/src/config/types.ts

@@ -93,7 +93,7 @@ export function getDefaultConfig(): Config {
       },
       mcp: {
         port: Number(process.env.MCP_PORT || 8080),
-        enabled: process.env.ENABLE_MCP === 'true' || true,
+        enabled: process.env.ENABLE_MCP === 'true',
       },
     },
     system: {