[DoodleBears]

Closes #2584 | Work claim

Why the change

A paired Remote Host now loads its chats from a different browser site instead of remaining unreachable when browser Fetch Metadata causes the internal DSH request to return403.

Special things to note

• Merge risk: two-way door—revert this commit; medium blast radius—the shared device HTTP forwarding boundary. Review that external Origin,cookie and device-credential admission still happens before forwarding; only four browser metadata headers are removed from the authenticated loopback hop.
• Verified18 gateway tests (the new case failed403 before the fix),lint,format,typecheck,build and both changelog checks; real macOS Chromium with two isolated Hosts reproduced403 →200 and rendered the remote Bot with zero console issues. Exact-head applicable CI also passed (three affected-test shards,docs build and isolated Host smoke). A subsequent direct DeepSeek-V4.1-Flash short desktop DM rendered and persisted correctly; iOS,Android,production Connect and full first-chat acceptance remain separate.
• Task codex/local/01a16230-879c-7ea2-bdc1-9f65f57a031a. No migration,CLI contract change or release action. The single-hop filter is fully shown below; a separate HTML explainer adds no detail to this short linear change.

Change outline

The device gateway keeps its external admission checks and its Host-held cookie,then builds the internal request without metadata belonging to the caller’s browser:

 Browser → device gateway: validate Origin + no ambient cookie + current device credential
 Gateway → native DSH API: Host-held cookie, loopback Host
- forward Sec-Fetch-Site / Mode / Dest / User from the external browser
+ discard these four headers on the internal hop

The regression fixture now reproduces pinned DSH0.2.1-rc.2’s cross-site Fetch Metadata refusal; existing unpaired,untrusted-Origin and ambient-cookie refusal coverage remains. The AX runbook records the diagnosed trap and a bilingual release fragment describes the visible fix.

Real desktop remote list —1440 ×1000,Chinese,dark theme

Same base 31f313fcdaf0d1758e3dd02285e6ba15a91bf884,same paired browser/Profile and same test Bot; only the gateway filter differs. Both pairing fingerprints were independently checked before device-key approval. The baseline computer name is masked; the after view has no visible private name.

Before—paired Host remains unreachable; its list request returns403.

After—the same remote Bot appears; list request returns200.