Harden API, desktop, and Drive trust boundaries

.env.example

@@ -47,10 +47,16 @@ CASE_LOCAL=1
 # Legacy: separate reply topic for handoff answers only. Must not equal TOPIC.
 # CASE_NTFY_ANSWER_TOPIC=
 
-# Public hostname when a reverse proxy fronts the API (adds /assist links to
-# notifications so a human can help from their phone). Unset on a laptop.
+# Public hostname served over HTTPS by a reverse proxy in front of the API.
+# Adds Assist links and signed approval buttons to ntfy notifications. Leave
+# unset on a laptop; those links and buttons are omitted.
 # CASE_PUBLIC_HOST=
 
+# Extra hostnames Drive and cased will answer to (comma-separated). Only needed
+# when something fronts them under another name; any other Host gets a 403.
+# CASE_PUBLIC_HOST is allowed without being repeated here.
+# CASE_ALLOWED_HOSTS=
+
 # Unlock the schedule_* MCP tools (recurring agent runs). Off by default to
 # keep the tool surface small.
 # CASE_MCP_SCHEDULES=1

.github/workflows/ci.yml

@@ -8,16 +8,19 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"
 
@@ -42,12 +45,7 @@ jobs:
       - name: Drive UI tests
         run: |
           npm --prefix web ci --omit=dev    # serve.mjs imports openai at module load
-          node web/web-ui/test_serve.mjs
-          node web/web-ui/test_ntfy.mjs
-          node web/web-ui/test_phone.mjs
-          node web/web-ui/test_telegram.mjs
-          node web/web-ui/test_nav.mjs
-          node web/web-ui/test_deploy.mjs
+          npm --prefix web test
 
   # Case is dual-licensed and sold commercially, which is only possible if the
   # project can sublicense every contribution. Deliberately no third-party CLA
@@ -58,7 +56,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Contributor has signed the CLA
         env:
           AUTHOR: ${{ github.event.pull_request.user.login }}
@@ -91,7 +89,7 @@ jobs:
   spdx:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Every source file declares its license
         run: |
           missing=0

.github/workflows/publish-image.yml

@@ -33,17 +33,17 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: ./image
           platforms: ${{ matrix.platform }}
@@ -58,7 +58,7 @@ jobs:
           mkdir -p /tmp/digests
           # filename is the bare hex; the merge job puts the sha256: prefix back
           touch "/tmp/digests/${DIGEST#sha256:}"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: digest-${{ strategy.job-index }}
           path: /tmp/digests/*
@@ -71,21 +71,21 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           path: /tmp/digests
           pattern: digest-*
           merge-multiple: true
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Tags
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ env.IMAGE }}
           tags: |

.gitignore

@@ -23,6 +23,9 @@ __pycache__/
 # Local git worktrees
 .worktrees/
 
+# Working notes — not part of the published repo
+docs/
+
 # Agent tooling state
 .claude/
 

CONTRIBUTING.md

@@ -24,30 +24,42 @@ New files take the `SPDX-License-Identifier` of their directory (see
 
 ## Tests (no Docker)
 
+Use Python 3.12 and Node 22, matching CI.
+
+```bash
+python3 -m venv .venv
+.venv/bin/pip install -r requirements-dev.txt
+for f in tests/test_*.py; do
+  case "$f" in tests/test_acceptance.py) continue ;; esac
+  .venv/bin/python "$f" || exit 1
+done
+npm --prefix web ci
+npm --prefix web test
+```
+
+## Acceptance tests (Docker)
+
 ```bash
-python3 -m venv .venv && .venv/bin/pip install -r requirements-dev.txt
-.venv/bin/python tests/test_lifecycle.py
-.venv/bin/python tests/test_dockerd.py
-.venv/bin/python tests/test_token.py
-.venv/bin/python tests/test_deskd.py
-.venv/bin/python tests/test_browse.py
-node web/web-ui/test_serve.mjs
-node web/web-ui/test_phone.mjs
-node web/web-ui/test_ntfy.mjs
-node web/web-ui/test_telegram.mjs
-node web/web-ui/test_nav.mjs
-node web/web-ui/test_deploy.mjs
+docker build -t case-desk:acceptance image
+CASE_ACCEPTANCE_IMAGE=case-desk:acceptance .venv/bin/python -m pytest -q tests/test_acceptance.py
 ```
 
-Acceptance tests (`tests/test_acceptance.py`) need Docker and a running cased.
+The suite starts its own cased on a random loopback port, with a temporary vault
+and token. It removes only computers created by that run. Failed runs retain
+logs and screenshots in the printed scratch directory. `CASE_KEEP=1` also keeps
+the primary test computer and its volume for inspection.
+
+A7 needs ntfy and a phone. A8 is skipped unless `CASE_A8=1` is set,
+because it restarts the Docker VM and interrupts every container using it.
+Run that check only on a dedicated test machine.
 
 ## Layout
 
-- `control-plane/` — REST API (composition root: `cased.py`)
-- `image/` — desktop container
-- `mcp/case_mcp.py` — MCP wrapper
-- `web/web-ui/` — Drive UI
-- `compose.yaml` — self-host stack
+- `control-plane/`: REST API (composition root: `cased.py`)
+- `image/`: desktop container
+- `mcp/case_mcp.py`: MCP wrapper
+- `web/web-ui/`: Drive UI
+- `compose.yaml`: self-host stack
 
 Be decent to people: [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
 

Dockerfile.ui

@@ -1,4 +1,4 @@
-# Drive UI. Proxies cased + noVNC on the compose network.
+# Drive UI. Proxies the API and live desktop through cased.
 FROM node:22-slim
 WORKDIR /app
 COPY web/package.json web/package-lock.json ./