merge: refresh login limiter branch against beta (keep both doc sections)

Signed-off-by: Tiberiu Socaci <tsocaci@makeitfuture.com>

Author: tbiyss

CHANGELOG.md

@@ -24,6 +24,17 @@ product overview.
   header that arrives on a loopback socket, and a global cap (50 failures per 10 minutes) bounds
   password guessing from fresh buckets. Deployments behind a proxy should set the new option;
   without it remote logins share one backoff bucket.
+- Security hardening (audit batch 1): the Slack Settings mode control no longer lets a non-admin
+  channel manager switch a channel into Admin mode (managers keep their other controls in an
+  Admin-mode channel and may step it down); case-variant URLs such as `/API/settings` are refused
+  by the admin guards and never routed; the admin shell and login page carry a no-inline-script
+  Content-Security-Policy and every response carries nosniff, frame-denial and referrer headers;
+  an Express error handler replaces default stack-trace responses and the systemd unit sets
+  `NODE_ENV=production`; `/resume` requires the admin session; the background-job "Check status"
+  button is gated like `/status` and scoped to its channel; file explorer share, send-to-me,
+  preview and edit re-prove the opened file under the channel root; the License card escapes
+  platform-supplied text; the internal IPC secret is compared in constant time; `npm audit fix`
+  moved undici, zod, hono, fast-uri, body-parser and ip-address to patched releases.
 
 - Supply new installations with Astra, Sol, Terra, Fable, Opus and Sonnet (`:sonet`) shortcuts
   using the newest supported stable family versions. Preserve customized lists and thread pins.

FEATURES.md

@@ -16,6 +16,39 @@
   still bounded, and so is the scrypt work an unauthenticated caller can cause.
 - Documented in `docs/OPERATIONS.md` → Reverse proxies and tunnels and in INSTALL.md: without the
   setting, all remote logins behind a proxy share one backoff bucket.
+## Web and Slack surface hardening (security audit batch 1)
+
+- **Admin mode is admin-only on every surface.** The Slack Settings mode control refuses to switch
+  a channel into Admin mode unless the clicker is a current organization admin, the same rule
+  `/mode admin` and the `set_channel_admin_mode` tool already enforce. A channel manager keeps
+  every other control in a channel that is already in Admin mode (changing Auto, Lean or the
+  network switch leaves the mode alone) and may step the channel down to Worker or Read-only; the
+  "Admin" option is listed only for someone who may enable it or when it is the current mode.
+- **Case-variant URLs never reach the admin router.** Express case-sensitive routing is on, and the
+  Host/Origin guard, the no-password lockdown, the 401 branch and the run-API key gate all compare
+  lowercased paths, so `/API/settings` is refused exactly like `/api/settings` instead of slipping
+  past them into the router.
+- **Security headers.** Every response carries `X-Content-Type-Options: nosniff`,
+  `X-Frame-Options: DENY` and `Referrer-Policy: same-origin`. The admin shell and the login page are
+  served with a Content-Security-Policy that admits same-origin scripts only plus the import map
+  by content hash (no inline script anywhere; the login handler lives in `public/login.js`),
+  same-origin styles with inline attributes, same-origin fonts, images and connections,
+  `frame-ancestors 'none'`, `object-src 'none'`.
+- **No stack traces.** One Express error handler answers unexpected failures with a bare 500 (logged
+  server-side) and keeps exposable client errors such as a malformed JSON body as their 4xx with
+  the message only; the systemd unit also sets `NODE_ENV=production`. `/resume` requires the admin
+  session; the `/internal/*` IPC secret is compared in constant time.
+- **Background-job status button.** "Check status" on a background job card runs through the same
+  authorization gate as `/status` (admin, approved, or an explicit guest of that channel) and only
+  reports a job that belongs to that channel; the log-tail fallback reads the channel's own log.
+- **File explorer exports re-prove the file.** Share, Send to me, Preview and Edit open the resolved
+  file `O_NOFOLLOW` and re-resolve the kernel descriptor through `/proc/self/fd`, refusing a file
+  that no longer sits under the channel root, which closes the symlink-swap race the agent-side
+  export tools already closed.
+- **License card.** The organization, tier and limit values from the licensing platform are
+  HTML-escaped before rendering.
+- **Dependencies.** `npm audit fix` applied: undici, zod, hono, fast-uri, body-parser and
+  ip-address moved to their patched releases; `npm audit --omit=dev` reports no vulnerabilities.
 
 ## Admin access to Slack controls
 

TEST-PLAN.md

@@ -22,6 +22,38 @@
   with the setting at **None**: every request shares the loopback bucket, so the 4th onwards is
   429/delayed regardless of the spoofed header. PASS when both hold and the setting round-trips
   after a daemon restart.
+## Web and Slack surface hardening, batch 1 (2026-10-25)
+
+- [x] Automated: `node scripts/run-tests.mjs test/web-hardening.test.js test/access-settings.test.js
+  test/admin-auth-bind.test.js test/admin-navigation.test.js test/run-control-auth.test.js
+  test/file-explorer-auth.test.js test/asset-versioning.test.js` — `/API/...` refused by the
+  lockdown / 401 branch and never routed; CSP + nosniff + frame denial on the shell and login page,
+  the import-map hash matching the served map, no inline script or handler in either page; a
+  malformed JSON body answers a bare 400 and the final 4-arity error handler is registered; the
+  internal IPC secret compared with `timingSafeEqualStr`; a manager's Settings save that selects
+  Admin is refused and writes nothing while an admin's succeeds, a manager keeps Admin when
+  changing flags and may step down, the picker lists "Admin" only to an admin or when current;
+  the `cg_bgjob_status` handler calls `authorizedControlEntry` and compares the job's slug; share /
+  send-to-me pass `rootPath`, preview and edit open through the `/proc/self/fd` re-check; the
+  License card escapes; the unit sets `NODE_ENV=production`.
+- [x] `npm run check:static`, `npm run secret-scan`, `npm audit --omit=dev` (0 vulnerabilities).
+- [ ] Live, engine-independent (browser): sign in to the admin UI through the deployment's public
+  hostname. Expected: the page renders and navigates normally (Overview, Conversations, Settings,
+  Skills, System health); the browser console shows no CSP violation; `curl -i https://<host>/`
+  shows `Content-Security-Policy: default-src 'self'; script-src 'self' 'sha256-…'` and
+  `X-Frame-Options: DENY`; `curl -i https://<host>/API/settings` answers 401 (password set) with
+  no settings payload; `curl -i -X POST https://<host>/api/login -H 'content-type: application/json'
+  -d '{bad'` answers 400 with `{"error":…}` and no stack. PASS when all four hold.
+- [ ] Live, Slack, engine-independent: in a test channel with `manageAccess: members` open Settings
+  as an approved NON-admin member. Expected: the Mode picker offers Read-only and Worker only;
+  switching Auto on succeeds and the channel stays in its mode. As an admin, pick Admin: the channel
+  enters Admin mode. Back as the member: the picker now shows Admin (current), ticking Network
+  succeeds and the channel stays in Admin mode, picking Worker steps it down. PASS when every step
+  matches and the audit events name the clicker.
+- [ ] Live, Slack, Claude AND Codex: in a Worker channel start `run_in_background` with
+  `sleep 90; echo done` (one run per engine). As an approved member click "Check status": an
+  ephemeral status appears. As a workspace member who is NOT approved and not a guest of the
+  channel, click the same button: nothing is posted. PASS when both hold for both engines.
 
 ## Harness default effort (2026-10-23)
 

package-lock.json

@@ -4240,8 +4240,8 @@ const LICENSE_STATE_LABEL = {
   expired_grace: "· grace expired",
 };
 
-const fmtLicenseLimit = (v) => (v === null || v === undefined ? "unlimited" : String(v));
-const fmtLicenseTime = (v) => (v ? new Date(v).toLocaleString() : "—");
+const fmtLicenseLimit = (v) => (v === null || v === undefined ? "unlimited" : escapeHtml(String(v)));
+const fmtLicenseTime = (v) => (v ? escapeHtml(new Date(v).toLocaleString()) : "—");
 
 function paintLicense(l) {
   document.getElementById("license-state-chip").textContent = LICENSE_STATE_LABEL[l.state] || `· ${l.state}`;
@@ -4255,9 +4255,11 @@ function paintLicense(l) {
   banner.textContent = l.banner?.text || "";
   banner.hidden = !l.banner;
 
+  // Everything here comes from the licensing platform's response. The key fields are already
+  // escaped below; the free-text ones must be too, because this list is rendered as HTML.
   const facts = [
-    ["Tier", l.tier === "none" ? "no key" : l.tier],
-    ["Organization", l.organization || "—"],
+    ["Tier", l.tier === "none" ? "no key" : escapeHtml(l.tier)],
+    ["Organization", escapeHtml(l.organization || "—")],
     ["Key", l.hasLicenseKey ? `…${escapeHtml(l.licenseKeyLast4)} (from ${escapeHtml(l.licenseKeySource)})` : "none"],
     ["Registered channels", fmtLicenseLimit(l.limits?.channels)],
     ["Registered users", fmtLicenseLimit(l.limits?.users)],

public/app.js

@@ -51,22 +51,7 @@
         <div class="err" id="err"></div>
       </form>
     </div>
-    <script>
-      document.getElementById("f").addEventListener("submit", async (e) => {
-        e.preventDefault();
-        const err = document.getElementById("err");
-        err.textContent = "";
-        const res = await fetch("/api/login", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ password: document.getElementById("pw").value }),
-        });
-        if (res.ok) return void (location.href = "/");
-        // A 403 here means no admin password is configured at all — show what the server says to
-        // do about it rather than the misleading "Wrong password."
-        const body = await res.json().catch(() => ({}));
-        err.textContent = body.error || "Wrong password.";
-      });
-    </script>
+    <!-- External on purpose: the page is served under a Content-Security-Policy with no inline script. -->
+    <script src="/login.js"></script>
   </body>
 </html>

public/login.html

@@ -0,0 +1,17 @@
+// Sign-in form handler for login.html. Kept out of the page so the admin UI can be served with a
+// Content-Security-Policy that admits no inline script.
+document.getElementById("f").addEventListener("submit", async (e) => {
+  e.preventDefault();
+  const err = document.getElementById("err");
+  err.textContent = "";
+  const res = await fetch("/api/login", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ password: document.getElementById("pw").value }),
+  });
+  if (res.ok) return void (location.href = "/");
+  // A 403 here means no admin password is configured at all — show what the server says to
+  // do about it rather than the misleading "Wrong password."
+  const body = await res.json().catch(() => ({}));
+  err.textContent = body.error || "Wrong password.";
+});

public/login.js

@@ -166,6 +166,7 @@ Group=$SERVICE_USER
 WorkingDirectory=$APP_DIR
 Environment=CHANNELGATE_DIR=$SERVICE_HOME
 Environment=HOME=$SERVICE_HOME
+Environment=NODE_ENV=production
 Environment=PATH=$SERVICE_PATH
 Environment=XDG_RUNTIME_DIR=$SERVICE_RUNTIME_DIR
 Environment=DBUS_SESSION_BUS_ADDRESS=unix:path=$SERVICE_RUNTIME_DIR/bus

scripts/install-systemd.sh

@@ -691,7 +691,7 @@ export class BackgroundJobs {
   status(id) {
     const j = this.jobs.get(id);
     if (!j) return null;
-    return { id: j.id, kind: j.kind || "shell", label: j.label, runtimeMs: Date.now() - j.startedAt, maxMs: j.maxMs, tail: j.tail || "", finished: Boolean(j.pendingDelivery) };
+    return { id: j.id, slug: j.slug || "", kind: j.kind || "shell", label: j.label, runtimeMs: Date.now() - j.startedAt, maxMs: j.maxMs, tail: j.tail || "", finished: Boolean(j.pendingDelivery) };
   }
 
   // The job's process (or engine run) ended. This is NOT the terminal boundary: the thread is

src/gateway/background.js

@@ -118,8 +118,14 @@ export function accessSettingsPatch(meta, form, actor) {
       throw new Error("Choose up to 100 valid users per list.");
     }
   }
+  // Admin mode is the posture every approval card relies on (permission prompts off for admin
+  // authors), so only an organization admin may switch a channel INTO it — the same rule `/mode
+  // admin` and the `set_channel_admin_mode` tool enforce. A manager may still leave it, and may
+  // change Auto/Lean in a channel that is already in Admin mode: keeping the current mode is not
+  // enabling it.
+  const canEnableAdmin = actor.isAdminUser === true || channelMode(meta) === "admin";
   const patch = {
-    ...modeSettingsPatch(meta, { mode: form.mode, autoMode: form.autoMode, cleanMode: form.cleanMode }, { canEnableAdmin: true }),
+    ...modeSettingsPatch(meta, { mode: form.mode, autoMode: form.autoMode, cleanMode: form.cleanMode }, { canEnableAdmin }),
     allowNetwork: form.allowNetwork, access: form.access, manageAccess: form.manageAccess,
     allowedUsers: [...new Set(form.allowedUsers)], managers: [...new Set(form.managers)],
     excludedUsers: [...new Set(form.excludedUsers)],