fix(webhooks): stop self-feeding inbound relay loop

[ralyodio]

The bug

The dashboard's inbound event log for moshcode.sh was full of inbound.inbound.inbound.…event entries, all from Bun/1.3.14.

Not a display bug. moshcode.sh has an active outbound target pointing at its own inbound receiver (https://moshcoding.com/api/webhooks/moshcode.sh), so:

1. An inbound POST is recorded, then relayed as inbound.<type>.
2. The relay lands back on the same receiver, which reads type: "inbound.event" out of our own envelope.
3. It relays inbound.inbound.event — and so on, forever.

The chain resets to bare event at 10 hops because the name exceeds the 80-char limit in normalizeInboundEventType, which returns null. The Bun/1.3.14 user-agent was the tell: fireDomainEvent was the only sender not setting a UA, so the server was POSTing to itself.

All 200 stored events for that domain (the per-domain cap) are loop junk.

The fix

Three independent layers, so no single topology reproduces it:

• relayEventType() — applies the inbound. prefix at most once, so prefix chains can't grow regardless of routing.
• isSelfWebhookUrl() (lib/url-guard.ts) — targets aimed at our own /api/webhooks/* are skipped in fireDomainEvent, dead-lettered in deliverToEndpoint, and refused with an explanatory message when added via the dashboard.
• x-moshcoding-hop counter, capped at MAX_RELAY_HOPS = 3 — bounds the same loop for hosts we can't statically recognize as ours (e.g. a custom domain proxied to this app).

fireDomainEvent now also sets a user-agent, so relayed events are identifiable in the log.

Trade-off

The self-target guard also blocks chaining domain A's outbound to domain B's receiver on moshcoding. That's a plausible-but-unused setup; the hop cap alone would have permitted it. Easy to relax if we ever want it.

Testing

bun test tests/ → 25 pass / 0 fail (was 22). bunx tsc --noEmit clean.

New coverage: prefix applied once across 12 simulated hops, hop-counter parsing/clamping, and self-URL detection (including the notmoshcoding.com near-miss).

Follow-up, not in this PR

• The stale self-referential domain_webhooks row for moshcode.sh is inert once this ships (deliveries to it are skipped), but is worth deleting.
• The 200 junk event rows age out under the existing per-domain cap.
• .github/workflows/test.yml skips when package.json has no test script — which is the case here, so these tests don't run in CI.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.