Risky behavior now covered

• The browser security gate rejects lookalike and non-loopback Origin values (127.0.0.1.evil.com, localhost.evil.com, evil.localhost, 127.0.0.2, [::2], blank) even when X-Cowork-Browser-Token or coworkBrowserToken is valid. OPTIONS stays a 403 instead of a CORS preflight, and those origins are not reflected in Access-Control-Allow-Origin.
• Loopback (127.0.0.1, localhost, [::1]), file://, and null origins still require the browser token. The header token wins over the query string; a whitespace-only header falls through; the first non-empty query value wins; the query name is case-sensitive.
• A network-exposed listener without an Origin reports Unauthorized server access. An empty configured token reports Browser access is not enabled for this server. /ws, /rpc, and the /cowork prefix (including /cowork-extra) require a token; / does not.
• Native tool search / programmatic tool calling follows model boundaries (gpt-5.4 vs gpt-5.3/gpt-5, gpt-6, Claude 3.5 Sonnet/Opus and Haiku 4.5 rejected, Haiku 4.5 still rejected when the id also contains opus-4) and official host suffixes (us.api.openai.com, foo.anthropic.com) rather than lookalikes (api.openai.com.evil.com, notapi.openai.com, openrouter.ai.evil.com).
• A blank base URL uses the official default. Forcing the native strategy on OpenRouter does not enable programmatic tool calling, and forcing it on Google does not invent OpenAI native tools.
• Interactive tool names are ineligible for programmatic calling regardless of case. Anthropic code execution also rejects schemas with a nested $ref; OpenAI and Codex do not. A runtime rejection of only tool search keeps programmatic calling, and a later rejection accumulates. Cache lookup ignores model case, surrounding whitespace, host case, and a trailing slash.

Test files added/updated

• crates/cowork-server/src/security.rs
• crates/cowork-providers/tests/native_tool_calling_and_capabilities.rs

No production behavior changes.

Why these tests materially reduce regression risk

These checks decide whether a browser can call the local server and whether a provider endpoint is sent native tool-search or code-execution payloads. Existing tests covered a plain evil origin without a token, gpt-5.4 vs gpt-4.1, and rejecting both native features at once. They did not cover a valid token combined with a lookalike host, host-suffix confusion, the model-version boundary, partial runtime rejection, or $ref tools being offered to Anthropic's code-execution container.

Validation

• cargo test -p cowork-server --lib security::tests — 4 passed
• cargo test -p cowork-providers --test native_tool_calling_and_capabilities — 7 passed
• cargo clippy -p cowork-server --lib --tests -- -D warnings — clean
• cargo clippy -p cowork-providers --test native_tool_calling_and_capabilities -- -D warnings — clean
• rustfmt --edition 2024 --check on both files — clean
• Full workspace suite not re-run