Risky behavior now covered

Untrusted providerOptions (workspace .cowork/config.json, session overrides, defaults apply, and child routing) may keep lmstudio.baseUrl only for a raw loopback host (localhost, 127.0.0.1, or ::1). These tests lock the cases a WHATWG-style parser would rewrite to loopback and that the strict filter must still drop:

• Decimal, hex, octal, and shortened IPv4 (2130706433, 0x7f000001, 0177.0.0.1, 127.1)
• Percent-encoded dots and trailing NULs (127%2e0%2e0%2e1, 127.0.0.1%00)
• Trailing-dot hosts (localhost., 127.0.0.1.)
• IPv4-mapped and zone-id IPv6 ([::ffff:127.0.0.1], [::1%eth0]), unspecified [::], and 0.0.0.0
• Port bounds and junk (65536, +80, 80:80, [::1]80)
• Equivalent ::1 spellings that must stay ([::1], [0:0:0:0:0:0:0:1], port 65535)
• The exception is only the baseUrl key: loopback base_url, baseURL, endpoint, extraHeaders, and api_key are still removed at the top level and inside openai, google, and lmstudio
• A workspace decimal-loopback URL does not replace a trusted user-tier LM Studio server

Test files updated

• crates/cowork-config/tests/strip_provider_option_endpoints_lmstudio.rs
• crates/cowork-config/tests/workspace_lmstudio_base_url_trust.rs

Why this reduces regression risk

This filter is the gate that stops a cloned repo or paired client from sending prompts and the saved LM Studio token to an attacker-chosen host. Switching the check to a normalizing URL parser would turn http://2130706433 into 127.0.0.1 and accept it. The new cases fail if that happens, and they also fail if a snake_case or header key is treated as the loopback exception. No production behavior changed.

Validation

• cargo test -p cowork-config --test strip_provider_option_endpoints_lmstudio --test workspace_lmstudio_base_url_trust (8 passed)
• cargo fmt -p cowork-config -- --check
• cargo clippy -p cowork-config --test strip_provider_option_endpoints_lmstudio --test workspace_lmstudio_base_url_trust -- -D warnings