audit+fix(security): the v1.7.3 surface Sessions 1-4 never read (V-01, V-02, F-01 residual)

[ojassug]

Audits the v1.7.3 surface Sessions 1–4 never read, then fixes everything it found. Two commits: the audit, then the remediation.

Closes §9.1 items 2 and 4 of the security review.

The audit (Session 5)

Passes 1, 3, 4 and 5 over c4f4149..445b3ed — the +859 / −223 across 17 files that landed after Sessions 1–3 read the tree and that Session 4 opened only where an existing finding touched it.

Two findings, both Gateway, both reproduced end to end. Seven clean results.

V-01 — the egress splice overwrote the wrong value

findMemberValue returned the first match; JSON.parse resolves a duplicate name to the last. The pipeline optimizes what the parser produced and the span says where to write it back, so the two rules disagreeing is not cosmetic. Given {"content":"A","content":"B"} the engine reasoned about B and the splice overwrote A:

• A destroyed outright
• B still present, unelided — the dedup saved nothing
• a marker the provider cannot resolve, in the wrong place

forwardableBody's never-grow guard does not catch it, because the corruption makes the body shorter. Same divergence on Anthropic's system field.

Fixed: last-match-wins. Verified end to end — the shadowed value survives and the real duplicate is elided, so the block appears once rather than twice. Both halves matter.

V-02 — Origin: null bypassed the browser-origin refusal

The guard read originHeader !== 'null', so the one Origin value a browser sends when it is most sandboxed — a sandboxed iframe, a data: URL, some redirect chains — was the one value exempted. Measured: a foreign origin → 403, no session; Origin: null → 200, session created.

Fixed: null is a foreign origin. An absent Origin still passes, because that is the non-browser client; the literal string null is a browser declining to name itself.

F-01's residual — and a reversal of my own earlier decision

The credential check ran after the stages, so a request ending in 401 had already created a session, stored its blocks and advanced the turn counter — and an empty session still occupies a slot under maxSessions, which is the whole eviction primitive.

This fix was refused earlier in the review, and the reversal is the substantive part. §3.1 assessed it vacuous because hasAuthHeaders tests presence rather than validity: a local process passes with Bearer anything. That reasoning covered one attacker and there are two. V-02 showed a browser reaches this handler, and a browser cannot set authorization on a simple request at all — the header is not CORS-safelisted, so asking for it forces a preflight this server answers 405 with no Access-Control-*. Against that caller the check is real.

§3.1's paragraph stands unedited in the report. The measurement was sound; the scope of the conclusion drawn from it was not, and §10.2 records that as a correction rather than an amendment.

Fixed: hoisted above getOrCreateSession. Measured — 20 unauthenticated requests leave sessionCount at 0; a rejected method creates nothing either.

A regression I introduced, caught by an existing test

Hoisting the 401 removed, as a side effect, the branch where allowMissingUpstreamCredentials answers locally instead of forwarding. gateway-response-headers.test.ts failed on it immediately — the M8 seam's own regression test doing exactly what it was written for. Restored explicitly in both routes.

ProxyRequestResult.session is optional as a consequence: a 401 or 405 now has no session to report, which is the point. No consumer reads that field off a result.

Clean results worth carrying

• The hand-written JSON scanner is iterative, not recursive — deeply nested attacker JSON cannot overflow the stack, the hazard a recursive scanner on a 10 MB body would carry.
• It is linear by measurement: 500 → 8,000 messages (116 KB → 1.86 MB) is 16× input for ~4× time, ms/KB flat, 1.86 MB in 22 ms.
• It never sees malformed JSON — JSON.parse runs first and returns 400.
• drift-tracker.ts's 332 changed lines touch no gate. shouldFallback, measurementGate and retentionGate appear 14 times in the file and zero changed lines contain any of them; thresholds identical in both trees. That negative was itself re-checked against the vacuous-grep failure mode §8.3 records.

Checks

98 test files / 914 tests pass, 2 skipped (POSIX-only file modes). Typecheck and lint clean. No corpus run: all three findings are Gateway-only, and the Gateway is off the corpus route entirely.

🤖 Generated with Claude Code