Skip to content

Harden API, desktop, and Drive trust boundaries - #9

Merged
ishu86 merged 51 commits into
mainfrom
harden/audit
Sep 5, 2026
Merged

Harden API, desktop, and Drive trust boundaries#9
ishu86 merged 51 commits into
mainfrom
harden/audit

Conversation

@ishu86

@ishu86 ishu86 commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Close the Host/Origin, live-view, and credential-injection gaps: desktops sit on case-desks and relay through cased, login rechecks the live page (HTTPS except loopback), deskd gates exec/files during injection, and uploads are capped at 8 MiB as the body arrives.
  • Lock down vault and phone handoffs: private vault perms, SQLite reads hold the connection lock, ntfy Approve/Deny only on signed HTTPS URLs when CASE_PUBLIC_HOST is set, and CI Actions are pinned to commits.
  • Refresh SECURITY.md, README, and CONTRIBUTING to match the enforced model. Working notes stay out of the tree (docs/ is gitignored). Existing desktop containers still need recreation to join case-desks.

Made with Cursor

ishu86 added 30 commits September 4, 2026 04:28
@ishu86
Check Host and Origin on every Drive request and websocket.
0f2fb53
@ishu86
Put desktops on their own network so only cased can reach them.
e3c33bd
@ishu86
Proxy the live view through cased with an explicit upstream header list.
cfd82d4
@ishu86
Return structured cased errors to the model and call the skill secret…
075d40a 
… check a lint.
@ishu86
Serve files from the computer as downloads, never as pages.
ce54f0b
@ishu86
Require the desk token on the VNC websocket and exit if Xvfb never st…
695ce63 
…arts.
@ishu86
Send Anthropic the screenshot, not its base64.
aca8099
@ishu86
Gate exec, actions and files during credential injection and scope fi…
cc3ff07 
…les to /home/agent.
@ishu86
Deliver the assist link, flatten prompts for ntfy, and sign the appro…
8a8344f 
…ve and deny buttons.
@ishu86
Write threads.json atomically and trim the small duplications.
12d37df
@ishu86
Check Host and Origin, open the token-in-URL doors, and authenticate …
b9d6b6d 
…before auditing.
@ishu86
Add an HTTP test for the auth and origin gates.
81a92a6
@ishu86
Clear the password field before the injection gate drops.
12f243f
@ishu86
Send the solver a page URL without its query string.
db81076
@ishu86
Cap file uploads, keep desk calls off the event loop, and require htt…
fba884f 
…ps for logins.
@ishu86
Build the observe script from the shared selectors.
8d92a2e
@ishu86
Keep the vault directory private and drop a computer's schedules with…
2865cce 
… it.
@ishu86
Pin the desktop image's base, packages and noVNC tarball, and add a h…
78c6f30 
…ealthcheck.

Follow-up: pip --require-hashes would need a full lock file for the deskd venv,
so the pins here are versions only.
@ishu86
Recreate a missing container on wake instead of raising AttributeErro…
e66b41f 
…r, and cap pids and swap.
@ishu86
Pin GitHub Actions to commits and drop CI's default write token.
a42313d
@ishu86
Keep vault secrets out of argv and build the create body as JSON.
3a153b1
@ishu86
Bump Pillow past its advisories and add websockets for the live relay.
f3ab428
@ishu86
Run the session keeper on its own thread.
4bdaaa0
@ishu86
Relay the live desktop view through cased.
fd1aa03
@ishu86
Fail abandoned login attempts, refuse sub-minute intervals, and keep …
3543ff3 
…daily schedules on wall-clock time across DST.
@ishu86
Make the session keeper non-reentrant and forget deleted computers.
b9a5d81
@ishu86
Delete dead assist and link helpers and the auth_attempts aliases.
53d706a
@ishu86
Point the assist tests at a host the new gate allows.
a488bfb
@ishu86
Merge branch 'harden/wp-d' into harden/audit
894e596
@ishu86
Merge branch 'harden/wp-f' into harden/audit
ccb04a8
ishu86 and others added 21 commits September 4, 2026 05:13
@ishu86
Merge branch 'harden/wp-e' into harden/audit
c82923c
@ishu86
Merge branch 'harden/wp-b' into harden/audit
73495bd
@ishu86
Merge branch 'harden/wp-c' into harden/audit
03c4c87
@ishu86
Drop the WP-B store stubs now that the real helpers have landed.
78a2026
@ishu86
Hoist the auth_attempts import and pin httpx for the test client.
47d8983
@ishu86
Describe the security model as the code now enforces it.
062900f
@ishu86
Say that the solver's page URL has its query stripped.
fa13b08
@ishu86
Say that in-container software, not just a compromise, can reach cased.
2b7f9cd
@ishu86
Say that desktops share a network and the desk token is what separate…
6dd7d33 
…s them.
@ishu86
Allow a login over http to the desktop's own loopback.
7663857
@ishu86
Calibrate A1's screenshot floor to what a real desktop measures.
195b056
@ishu86
Give the acceptance fixture a name no human would pick.
f313ed1
@ishu86
Hold the SQLite lock until shared cursors have been read.
e1f31bf
@ishu86
Isolate acceptance tests and clean up only the computers they create.
fed5082
@ishu86
Recheck credential origins and enforce desktop request limits.
9bada3b
@ishu86
Send ntfy approval actions to the signed public HTTPS URL.
a6ec2a8
@ishu86
Update cryptography and the desktop build tools past their advisories.
727c187
@ishu86
Document the verified hardening fixes and remaining security limits.
4fd771c
@ishu86
Put the first run in the README and move detailed setup into guides.
7051d42
@ishu86 @cursoragent
Keep working notes in docs/ out of the published tree.
659b71d 
Co-authored-by: Cursor <cursoragent@cursor.com>
@ishu86
Keep setup guides in the README and highlight managed Case.
f94a849
@ishu86
ishu86 merged commit 18d520b into main Sep 5, 2026
3 checks passed
@ishu86
ishu86 deleted the harden/audit branch September 5, 2026 06:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ishu86