From c7af2c09ef45faa4367c0e2a9f770fb73a62a612 Mon Sep 17 00:00:00 2001 From: Dominik Jain Date: Wed, 5 Aug 2026 21:35:18 +0200 Subject: [PATCH] SerenaDashboardTrayManager: Configure trusted hosts (local hosts only) --- CHANGELOG.md | 3 ++- src/serena/dashboard.py | 7 +++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 98bcf0c6..256dd973 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,7 +13,8 @@ Status of the `main` branch. Changes prior to the next official version change w - Project activation errors are now reported to the client in Serena's system prompt, instead of failures being visible only in the log. This applies both to a failed activation of an explicitly given project and to a failed `--project-from-cwd` auto-detection (#1773). - - ProjectServer: Configure trusted hosts for localhost case + - ProjectServer: Configure trusted hosts (local hosts only) when listening on localhost + - SerenaDashboardTrayManager: Configure trusted hosts (local hosts only) * CLI: - Fix: `start-mcp-server` help text for `--project-from-cwd` falsely promised a fallback to the CWD, which was diff --git a/src/serena/dashboard.py b/src/serena/dashboard.py index c9873608..b92fcb51 100644 --- a/src/serena/dashboard.py +++ b/src/serena/dashboard.py @@ -207,7 +207,7 @@ class SerenaDashboardAPI: self._tool_names = tool_names self._agent = agent self._host = host - self._app = Flask(__name__) + self._app = Flask(self.__class__.__name__) if trusted_hosts: self._app.config["TRUSTED_HOSTS"] = trusted_hosts self._tool_usage_stats = tool_usage_stats @@ -966,6 +966,8 @@ class SerenaDashboardTrayManager: HOST = "127.0.0.1" """listen address (local only)""" + TRUSTED_HOSTS = ["localhost", "127.0.0.1"] + ALIVE_CHECK_INTERVAL_SECONDS = 3 """interval in seconds between alive checks of registered instances""" @@ -984,7 +986,8 @@ class SerenaDashboardTrayManager: self._lock = threading.Lock() self._tray_icon: Optional["pystray.Icon"] = None self._alive_check_use_pid = alive_check_use_pid - self._app = Flask(__name__) + self._app = Flask(self.__class__.__name__) + self._app.config["TRUSTED_HOSTS"] = self.TRUSTED_HOSTS self._setup_routes() self._use_pywebview = use_pywebview