Harden release console token bootstrap

tools/release/release-console.py

@@ -32,7 +32,9 @@ def main() -> int:
     app = create_app(workspace_root=workspace_root, token=token)
     url = f"http://{args.host}:{args.port}/"
     if token:
-        url = f"{url}?token={token}"
+        # URL fragments are never sent in HTTP requests. The WebUI transfers
+        # this one-time bootstrap token to sessionStorage and clears the hash.
+        url = f"{url}#token={token}"
     print("GovOPlaN release console")
     print(f"  workspace: {workspace_root}")
     print(f"  url:       {url}")

tools/release/server/app.py

@@ -85,7 +85,7 @@ def create_app(*, workspace_root: Path = DEFAULT_WORKSPACE_ROOT, token: str | No
     @app.middleware("http")
     async def require_token(request: Request, call_next):  # type: ignore[no-untyped-def]
         if token and request.url.path.startswith("/api/"):
-            provided = request.headers.get("x-release-console-token") or request.query_params.get("token")
+            provided = request.headers.get("x-release-console-token")
             if provided != token:
                 return JSONResponse({"detail": "release console token required"}, status_code=401)
         return await call_next(request)

tools/release/webui/index.html

@@ -768,11 +768,15 @@
     </div>
 
     <script>
-      const params = new URLSearchParams(window.location.search);
-      const token = params.get("token") || sessionStorage.getItem("releaseConsoleToken") || "";
+      const fragmentParams = new URLSearchParams(window.location.hash.slice(1));
+      const fragmentToken = fragmentParams.get("token") || "";
+      const token = fragmentToken || sessionStorage.getItem("releaseConsoleToken") || "";
       if (token) {
         sessionStorage.setItem("releaseConsoleToken", token);
       }
+      if (fragmentToken) {
+        history.replaceState(null, document.title, `${window.location.pathname}${window.location.search}`);
+      }
 
       const elements = {
         channel: document.getElementById("channel"),