[feature] Self-host: allow exact local origins while EXECUTOR_ALLOW_LOCAL_NETWORK stays off #2149

The problem

A self-hosted Executor sometimes needs to call one API on its own host, such as a read-only internal service bound to 127.0.0.1:<port> that must never be exposed on a routable address. With EXECUTOR_ALLOW_LOCAL_NETWORK=false, the hosted HTTP client (validateHostedOutboundUrl in packages/core/sdk/src/hosted-http-client.ts) refuses every loopback and private address. That blocks the spec fetch and every tool call to that source. Pasting the spec avoids the fetch, but tool calls are still refused.

The only switch is EXECUTOR_ALLOW_LOCAL_NETWORK=true, and that opens everything local. Built-in tools an MCP client can call, such as openapi.previewSpec, integrations.detect and oauth.probe, would then fetch or probe any loopback service, the LAN, and ranges like Tailscale's 100.64.0.0/10. When Executor fronts an agent that reads untrusted content, that undoes the reason for keeping the flag off.

Proposed shape

An exact-origin allowlist that works while allowLocalNetwork stays off:

• HostedHttpClientOptions.allowedLocalOrigins?: ReadonlyArray<string>, wired from HostConfig in scoped-executor.ts. Self-host reads it from EXECUTOR_ALLOWED_LOCAL_ORIGINS (comma-separated).
• An entry must be a bare http(s)://<ip literal>[:port] origin, with no path, query or credentials. Hostnames are rejected, so DNS never decides. Metadata addresses (169.254.169.254 and friends) are refused. A malformed entry stops the server at boot.
• A request matches only when its URL origin equals an entry exactly (scheme, host and port). Everything else is validated as today, and every redirect hop is still checked on its own.

The change is small and backwards compatible; a PR follows.

Alternatives

• EXECUTOR_ALLOW_LOCAL_NETWORK=true: opens every private address to the tools above.
• Binding the service to a routable or public-looking address: it exposes the service, or relies on gaps in the blocklist.
• A hostname that resolves to loopback: already blocked by the resolver check, correctly.
• Stdio MCP (EXECUTOR_ALLOW_STDIO_MCP): lets integrations spawn arbitrary commands, which is a much larger grant.

Where it belongs

Self-host (apps/host-selfhost) and the shared SDK HTTP client. Cloud hosts can ignore it.

Before you submit

• I searched the open issues for a duplicate.