assertProviderBaseUrlIsSafe (security/provider-endpoint.ts)

Validates provider URLs to prevent plaintext credential leakage over non-loopback networks.

// Source: https://github.com/greyhaven-ai/autocontext | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Provider credentials and prompts must not leave loopback over plaintext.
 * Keep this check at the server/auth boundary; TUI callers also invoke it
 * before sending credentials as defense in depth.
 */
export function assertProviderBaseUrlIsSafe(baseUrl?: string): void {
  if (!baseUrl) return;
  let url: URL;
  try {
    url = new URL(baseUrl);
  } catch {
    throw new Error("provider base URL must be a valid http(s) URL");
  }
  if (url.username || url.password) {
    throw new Error("provider base URL must not contain embedded credentials");
  }
  if (url.protocol ===

... (truncated -- full source via MCP)