fix: authorize CLI probes and preserve executable identity

src/server/claude-code.ts

@@ -1,8 +1,27 @@
 import { inspectClaudeInstallation } from "../agent/claude-code/installation.ts";
 import { initAuthEnv } from "./keys.ts";
+import { subscriptionRequestOrigin } from "./web-subscription-http.ts";
 
 /** The Settings status seam: initialize provenance before any child env is copied. */
 export async function claudeCodeInstallationStatus() {
 	initAuthEnv();
 	return inspectClaudeInstallation();
 }
+
+/** Same-origin browser intent, not user authentication. No CORS grants.
+ * A public/shared server still requires its own access-control boundary. */
+export async function claudeCodeInstallationResponse(
+	request: Request,
+	inspect = claudeCodeInstallationStatus,
+): Promise<Response> {
+	const origin = subscriptionRequestOrigin(request);
+	const supplied = request.headers.get("origin");
+	const headers = { "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff" };
+	if (request.method !== "GET" || !origin
+		|| request.headers.get("x-learnharness-claude-code") !== "1"
+		|| request.headers.get("sec-fetch-site") === "cross-site"
+		|| (supplied !== null && supplied !== origin)) {
+		return Response.json({ error: "Claude Code checks require a same-origin LearnHarness request." }, { status: 403, headers });
+	}
+	return Response.json(await inspect(), { headers });
+}

src/server/index.ts

@@ -45,4 +45,4 @@ export * from "./observability.ts";
 export * from "./model-catalog.ts";
 export { subscriptionControlsResponse, subscriptionBrowserResponse } from "./web-subscription-http.ts";
 export { sessionCost } from "./pricing.ts";
-export { claudeCodeInstallationStatus } from "./claude-code.ts";
+export { claudeCodeInstallationResponse } from "./claude-code.ts";