[fedacking]

Closes #184. This is Phase 0 of #181, "stop the leaks", done without the GitHub App.

Exit criteria

• No user token in any container.
• CSRF-safe login.
• Sessions stop working within minutes of a user losing org access or their role.

There is one commit per item, so it can be reviewed commit by commit. 0.2 has two: tokens out of previews, then isolating the preview build itself. 0.5 has two: token encryption, then moving the dashboard secrets out of persistent storage.

Commit	Item
0.1	No tokens in agent containers. New host-side repo_sync.rs fetches into a root-owned bare cache, with the token passed through GIT_CONFIG_* env (never in argv or on disk), and ships git bundles into agents. Agent remotes are plain URLs, and existing containers are scrubbed at startup. Agents no longer push: delivery is always createCommitOnBranch, and auto_create_pr=false now only suppresses the PR.
0.2	No user token in preview containers. preview.sh fetches on the host and streams a bundle into the container, where the preview user checks it out. /etc/preview-token and credentialed .git/config are gone. preview scrub-tokens cleans existing previews and runs on deploy and before each update. hostSecrets lookup is now exact-match and refuses infra keys (GITHUB_*, WEBHOOK_*, PREVIEW_*, ADMIN_SSH_KEY, ALLOWED_REPOS).
0.2	Untrusted preview-config.nix can't reach host secrets. The repo's config used to be evaluated as root with --impure, so it could readFile /run/dashboard-secrets, /var/secrets or any host file, and copy the contents into /nix/store (readable by everyone and mounted in every container) or send them out. Its fixed-output builds could also reach loopback, where /internal/secrets (any repo's decrypted secrets), the webhook's /internal/token and Caddy's admin API trust the caller. Now evaluation runs through systemd-run as a throwaway DynamicUser: Nix's restrict-eval is on, there's no network (IPAddressDeny=any), the environment is empty, and the secret paths are hidden. Restricted mode alone isn't enough, because getFlake "path:/dir" still copies any readable host dir into the store. nixpkgs comes from /etc/nixos/flake.lock as a locked store path, so closures are byte-identical to before. A tekton-nixbld firewall chain rejects traffic from nixbld build users to loopback and to private and link-local addresses, DNS excepted. preview.sh refuses to build without the chain. Swap is pinned off, so the tmpfs secrets can't be paged out.
0.3	OAuth state on login. A 10-minute oauth_state cookie, checked with a constant-time compare. Cancelling on GitHub now redirects home.
0.4	Sessions follow GitHub reality. session_version in the JWT and DB, and role always read from the DB. Org membership is re-checked after 10 minutes, or 2 minutes for member and admin actions. Losing membership or having the token revoked ends every session. Transient GitHub errors get a bounded grace (1 h, or 10 min for privileged actions) and never revoke. Role changes bump the version.
0.5	Encrypt stored GitHub tokens. Legacy plaintext tokens are encrypted and NULLed at startup. Every read goes through auth::load_github_token.
0.5	Secrets live in 1Password, not on disk. SECRETS_ENCRYPTION_KEY, JWT_SECRET and GITHUB_CLIENT_SECRET live in 1Password and on the server only in /run/dashboard-secrets/secrets.env (tmpfs). The unit requires that file, so the dashboard won't start without it. There is no 1Password CLI: an authorized op session would let anything in that terminal read every vault. Instead, server-config/dashboard-secrets.sh set <server> asks for each value at a hidden prompt on the server, and you paste it from the 1Password app. It writes the file atomically and refuses an empty or partial one. It also refuses a SECRETS_ENCRYPTION_KEY that doesn't match the running dashboard's key, unless you pass --new-key. Any pasteable value works: they're written double-quoted with systemd escaping. Values never reach argv or shell history, never touch the laptop's disk, and aren't echoed. check-live, copy-live and verify-key support the move from the old setup without printing values. At startup the backend refuses a key that decrypts none of the oldest stored values, before encrypting legacy tokens, and removes the three from its environment so child processes (agent, preview, git, chromium) don't inherit them. deploy.sh checks before restarting the dashboard: the file must be present and complete, the unit must load it, and no copies may remain in dashboard.env or old key files. After the restart, it checks the service actually came up. server-setup.sh writes the /run file instead of dashboard.env, and refuses to mint new secrets on an existing install. Threat model: this protects DB dumps, backups, disk images and file reads. It doesn't protect live root or memory reads, which nothing local can.
0.6	Guard intake and Sentry. Before each poll or spawn, run_as_user must still be an org member with a usable token. Otherwise the source is auto-disabled, with a visible reason and a system audit event. Without a label filter, only OWNER/MEMBER/COLLABORATOR issues are taken. Issue text goes inside a per-prompt random <untrusted_issue_*> fence, with marker neutralization and single-pass template substitution. Prompts are rebuilt when the task spawns.
0.7	Provenance. Commits get Tekton-Task and Co-authored-by trailers. PR bodies end with a footer: requested by, a task link, and the model. A new tasks.model column records the model.

Breaking changes and deploy notes

• Preview configs: each target repo's preview-config.nix must drop its git clone/fetch step, because the code is now provided at /home/preview/app (PREVIEW_CODE_PROVIDED=1). Old configs keep working only for public repos.
• Preview build isolation: manual step on prod. deploy.sh never copies configuration.nix, so copy the networking.firewall.extraCommands/extraStopCommands blocks and the swap settings into /etc/nixos/configuration.nix on the server, then run ./deploy.sh <server> nix. Until then, previews refuse to build, and deploy.sh warns. See "Isolating preview builds" in docs/deployment-guide.md.
• Preview configs can't fetch at evaluation time: builtins.fetchTarball/fetchGit/fetchurl, readFile of host paths and getEnv now fail. Derivation fetchers (pkgs.fetchurl, fetchFromGitHub) still work.
• Rotate tokens after deploy: old previews exposed the server GITHUB_TOKEN in /var/secrets/preview.env, and user OAuth tokens, to app code. Scrubbing doesn't undo that exposure.
• Old backups: backups and WAL taken before the upgrade still contain live plaintext tokens. Run VACUUM FULL users; after the first start.
• Dashboard secrets: manual upgrade on prod. Follow "Upgrading an existing server" in docs/deployment-guide.md:
  1. Run dashboard-secrets.sh check-live <server> to confirm the live values can be entered at the prompt. It never prints them.
  2. Create the 1Password item key-tekton-00 in the Tekton vault, with fields SECRETS_ENCRYPTION_KEY, JWT_SECRET and GITHUB_CLIENT_SECRET.
  3. Copy the existing key and client secret in, by running dashboard-secrets.sh copy-live <server> NAME | pbcopy and pasting in the app. Don't generate a new key, because existing secrets are encrypted with it.
  4. Generate JWT_SECRET in the app. A new one signs everyone out.
  5. Run dashboard-secrets.sh verify-key <server> and paste the key. Don't continue until it says OK.
  6. Run dashboard-secrets.sh set <server> and paste the three fields.
  7. Hand-edit /etc/nixos/configuration.nix on the server to add the EnvironmentFile, since deploy.sh doesn't copy that file.
  8. Remove the three lines from /var/secrets/dashboard.env.
  9. Run ./deploy.sh <server>.
• After a reboot, the dashboard stays down until someone runs dashboard-secrets.sh set <server> and pastes the three values again, because tmpfs is wiped. This is accepted for now. If reboots become frequent, we'll revisit (TPM-sealed systemd credentials are the likely next step).
• Losing the key: if the 1Password item is lost, users must sign in again, every intake and Sentry source gets auto-disabled, and repo secrets, AI keys and Sentry tokens must be re-entered. Rolling back past 0.5 breaks tasks until users sign in again.
• Local dev: make deps writes a random SECRETS_ENCRYPTION_KEY into new .env files. Existing .env files that only have SECRETS_ENCRYPTION_KEY_FILE need a SECRETS_ENCRYPTION_KEY line, plus JWT_SECRET and GITHUB_CLIENT_SECRET set to non-empty values.
• Other behaviour changes:
  • Intake tasks with auto_create_pr off now get a pushed branch and previews.
  • Role changes sign the user out.
  • Branch names containing ' or whitespace are rejected by preview.sh.
  • PREVIEW_*-named hostSecrets are no longer forwarded.

Verification

• Automated:
  • cargo fmt --check, cargo clippy --all-targets -D warnings and cargo test pass (60 tests). They include real-git file:// tests for clone, reopen, thin-bundle fallback and tags, plus a guard that x-access-token and extraHeader appear only in repo_sync.rs.
  • Frontend npm run lint (0 errors) and npm run build pass.
  • bash -n and shellcheck pass on preview.sh and deploy.sh. bash -n passes on server-setup.sh and dashboard-secrets.sh.
  • The startup key check was run against a local Postgres 18:
    • The right key starts.
    • A wrong key refuses, even when newer rows use the wrong key.
    • One bad row among good ones still starts.
    • e2e/seed.sql passes with the CI key.
  • dashboard-secrets.sh and the deploy.sh preflight were run in a local expect/pty harness, with macOS bash 3.2 on the laptop side, bash 5 for the server side, and systemctl stubbed. It covered:
    • Byte-exact round trips of values with spaces, ', ", $, backticks and backslashes.
    • Bracketed and multi-line pastes.
    • Live-key mismatches.
    • Ctrl-C mid-prompt, which leaves no temp file.
    • No pasted value ever showing in the transcript.
    • Old key files, a unit that doesn't load the file, and a crash loop after set.
  • The systemd env-file quoting rules were checked against an independent reimplementation, not real systemd.
  • Preview build isolation was checked with Nix 2.33 on macOS, using the real locked_nixpkgs_ref. The template config gives the same toplevel .drv as the old unrestricted path, and previewMeta evaluates. readFile of host paths, every URL fetcher (loopback included) and getEnv are refused. getFlake "path:/dir" still copies a host dir under restricted mode alone, so on Linux the DynamicUser layer is what stops it.
• Not yet run:
  • The Playwright e2e suite.
  • dashboard-secrets.sh against a real server (Linux tty handling, real systemd parsing), and the 9-step secrets upgrade.
  • Everything on a staging host: agents and previews on a private repo, nixos-container run stdin, runuser in the container, scrub-tokens, the membership revocation flow, intake auto-disable, and the GitHub App webhook path. Also the systemd-run sandbox (daemon access as a DynamicUser, --pipe output), the tekton-nixbld chain, and a canary config that hashes /run/dashboard-secrets/secrets.env (it must fail), plus a fixed-output build that curls 127.0.0.1:3200 (it must be rejected).
  • These checks are in the plan's manual verification table.
• To confirm on staging: whether a run_as_user with private org membership shows up as CONTRIBUTOR on Sentry-created issues, which the author filter would drop.

Follow-ups (out of scope)

• WebSocket routes /ws/tasks/{id} and /ws/logs/{slug} have no auth.
• generate_pr_body runs claude --dangerously-skip-permissions on the host with untrusted text.
• nix build --impure on a repo-controlled preview-config.nix runs as root and can read /var/secrets/*.
• Stored token ciphertext isn't bound to the user (no AAD). The same is true of repo secrets.
• GITHUB_WEBHOOK_SECRET is still on disk in dashboard.env and preview.env. A setup.env copy may remain in /opt/src/setup.env on the server.
• The fallback commit email uses {login}@users.noreply.github.com. It should use the id-based form; store the GitHub user id at login.

🤖 Generated with Claude Code