[hessabi]

Proposal 7 in #4.

What was wrong

• cloud.mjs sent bearer-authenticated create/get/message calls to DEVIN_API_URL exactly as given. A malicious or mistyped value could send the API key to any host, or to a URL carrying credentials or a path.
• Redirects on those requests were followed.

What changed

• New resolveApiOrigin(env):
  • Unset: uses https://api.devin.ai.
  • The only other accepted value is exactly that origin, with an optional trailing slash; host casing is normalized.
  • Rejected before any fetch: userinfo, paths, queries, fragments, other ports, other hosts, plain http, whitespace or control characters, and look-alike or IDN tricks. Error messages never echo the raw URL.
• Loopback is test-only and opt-in. It's accepted only with DEVIN_COMPANION_ALLOW_LOOPBACK_API=1, for http(s) on 127.0.0.1, [::1] or localhost, on any port.
• getCloudConfig no longer throws. It returns apiUrl: null and apiUrlError. resolveApiBase and apiRequest both refuse to build or send a request when that error is set.
• apiRequest uses redirect: "error" and treats any 3xx as an error.
• /devin:setup reports a rejected URL instead of crashing, and /devin:handoff fails before it creates a job.
• Docs updated: README, AGENTS.md, and the handoff command.

How tested

• New tests/cloud-url.test.mjs, 16 tests, all against a mocked globalThis.fetch:
  • 58 malicious URL variants, each making zero fetch calls and sending no Authorization header, for create, get and message, with both personal and service keys.
  • The default and exact-origin values succeed.
  • Loopback is rejected without the opt-in and accepted with it.
  • A 302 makes no second request.
  • setup and handoff behave correctly through the CLI.
• node --test: 44 pass, 0 fail.

[TheOnlyFusionCube]

Verified test suite (44 passed across 58 origin/redirect assertions). Clean implementation of Proposal 7.