fix: require application/json on dashboard POST endpoints

[SashaMIT]

Summary

• The dashboard control plane (/api/approvals/<id>/resolve, /api/inject, /api/select-run) drives a running agent: it resolves pending approvals and injects operator instructions.
• _read_json_body parses the payload regardless of Content-Type, and browsers may send cross-origin "simple" POSTs (text/plain/form-encoded) without a CORS preflight. Any page the operator visits while the dashboard is up could therefore inject instructions or resolve approvals on their behalf.
• Require an application/json Content-Type on all POSTs. Cross-origin attempts then become preflighted requests, which this server never answers. The bundled UI already sends application/json on every POST, so nothing changes for legitimate use.

Test plan

• tests/test_dashboard_server.py: POST with text/plain / no Content-Type → 415; POST with application/json (with/without charset) → accepted.

Made with Cursor

Made with Cursor

[lerogo]

Thank you for the contribution! Could you please simplify this PR before we merge it?

• Remove uv.lock and the added tests; they are not needed for this small change.
• This is a local-only dashboard, so please keep the implementation minimal.
• Do not validate Content-Type before routing, as unknown paths would return 415 instead of 404.
• Avoid startswith("application/json"), which also accepts invalid values such as application/json-invalid.

Please keep the change focused and preserve the existing routing behavior. Thanks again!

[SashaMIT]

Thanks for the review, all four points addressed and pushed:

• Removed the tests and uv.lock; the PR now touches only server.py.
• The check runs after routing, so unknown paths keep their 404.
• Switched to an exact Content-Type: application/json comparison, so values like application/json-invalid are rejected.
• Scope narrowed to the two routes that drive a running agent (approval resolve + instruction inject); /api/select-run is browse-only state and left untouched.

Verified live: text/plain gets 415, unknown paths still 404, and the bundled UI already sends bare application/json on both guarded routes, so it is unaffected.

[SashaMIT]

Superseded by #11, which adds the loopback Host gate, covers select-run, and allows charset on application/json. Closing this incomplete CSRF-only PR in favor of that one.