sync: update from private repo (dd02d18)

src/bridge/server.ts

@@ -29,6 +29,7 @@ import { mountAdminApi } from './admin-api.js';
 import { createAdminGatewayApi } from './admin-gateway-api.js';
 import { mountUsersApi } from './users-api.js';
 import { mountShareApi } from './share-api.js';
+import { securityHeadersMiddleware } from './security-headers.js';
 import { mountLocalTasksApi } from './local-tasks-api.js';
 import { findPieceFile } from './pieces-api.js';
 import { mountLocalFilesApi } from './local-files-api.js';
@@ -191,15 +192,11 @@ export function createCoreServer(opts: CoreServerOptions): {
   // Don't advertise the framework/version (minor info-leak, free to drop).
   app.disable('x-powered-by');
 
-  // Baseline hardening header on every response. `nosniff` stops the browser
-  // from MIME-sniffing a response into something executable. File-serving
-  // endpoints add `Content-Security-Policy: sandbox` on top
-  // (see setUntrustedFileResponseHeaders) to neutralize stored XSS from
-  // agent/user-authored workspace files.
-  app.use((_req, res, next) => {
-    res.setHeader('X-Content-Type-Options', 'nosniff');
-    next();
-  });
+  // Baseline hardening headers on every response (nosniff, X-Frame-Options,
+  // Referrer-Policy, and HSTS over TLS). File-serving endpoints add
+  // `Content-Security-Policy: sandbox` on top (see setUntrustedFileResponseHeaders)
+  // to neutralize stored XSS from agent/user-authored workspace files.
+  app.use(securityHeadersMiddleware());
 
   // リバースプロキシ背後で secure cookie / X-Forwarded-Proto を正しく処理
   if (opts.authConfig?.secureCookie) {