Integrate security hardening PRs 1885, 1886, 1887

[simple-agent-manager]

Summary

• Integrates the accepted heads of security hardening PRs Harden deploy workflow shell inputs #1885, Fix node diagnostic raw-surface auth boundary #1886, and Harden deployment image registry resolution #1887 into one mega PR against latest origin/main.
• Preserves constituent PRs open/unmerged by using an integration branch and requiring squash merge for this PR.
• Adds two integration release fixes found during skeptical review/staging: propagates documented DEPLOYMENT_IMAGE_RESOLVE_* Worker vars through deployment config generation, and binds the default image-resolver fetch as globalThis.fetch(input, init) so Cloudflare Workers host functions keep the required receiver. Both fixes have regression tests.

Pinned constituent heads verified before integration:

• Harden deploy workflow shell inputs #1885: 5b713fc41f0f6d79c5ef77cfbca727fc7f4c70c7
• Fix node diagnostic raw-surface auth boundary #1886: 0e1e5de105a672c93c764d186aed2da88442cbb7
• Harden deployment image registry resolution #1887: d830c8f28686c1eb04f977ab826275aee5799aad

Integration evidence:

• Base: origin/main at b672af2312a4a362a106cc2f5ed3b6460014c6d3
• Initial constituent-only integrated commit: b5fa49028fcba5d18f53cfc4a55b3192e42f92de
• Current integration head: 6da7ed53ecb03fe1aba7ec2fbc4da15a6ce52ada
• Initial stable patch-id matched constituent union exactly: 7012e39200aab6ab3af8c8396c2c4e965c43c671
• .codex/config.toml is absent from the mega diff.

Validation

• pnpm lint
• pnpm typecheck
• pnpm test
• Additional validation run (if applicable)
• If this PR changes candidate selection for a sweep/cron/alarm loop (WHERE clause, status set, join, or equivalent), expected candidate volume and worst-case per-candidate cost are stated in the summary or validation notes (see `.claude/rules/47-control-loop-io-budget.md)

Additional validation already run:

• pnpm exec vitest run scripts/quality/sync-wrangler-config.test.ts scripts/quality/deploy-reusable-workflow.test.ts scripts/quality/deployment-workflow-hardening.test.ts apps/api/tests/unit/image-resolver.test.ts — passed, 162 tests.
• pnpm --filter @simple-agent-manager/api test -- tests/unit/routes/deployment-release-compose-submission.test.ts tests/unit/routes/node-observability-logs.test.ts tests/unit/services/release-tag-resolution.test.ts — passed, 22 tests.
• cd packages/vm-agent && go test ./internal/server — passed.
• cd packages/vm-agent && go test ./... — passed.
• cd packages/cli && go test ./... — passed.
• pnpm lint && pnpm typecheck && pnpm test && pnpm build — passed.
• pnpm check:fast — passed; baseline warnings only.
• pnpm quality:scripts:test — passed, 38 files / 517 tests.
• Deterministic quality gates passed: quality:wrangler-bindings, quality:agent-install-manifest, quality:skill-references, quality:ast-checks, quality:file-sizes, quality:stale-artifacts, quality:migration-safety, quality:do-migration-safety, quality:source-contract-tests, quality:no-tracked-stale-binaries, quality:observability-noise, quality:dependency-governance, quality:workspace-test-surfaces, quality:migration-ordering, quality:repo-visibility, quality:runtime-boundary-semantics, quality:direct-dependency-evidence, quality:govulncheck-diff.
• Pinned Gitleaks v8.30.1: quality:gitleaks:current passed (53 reviewed baseline findings, 0 new); quality:gitleaks:pr passed (0 findings).
• Live quality:do-wall-time after exact-head staging deploy is still red for sam-api-staging / 95fdea1992ac4f6cb80ca133c0500e3c / 01KRXWNWXCR9ZQCV5VY4VBHBRP / alarm: recent 2026-08-22T08:21:12.779Z–2026-08-23T08:21:12.779Z, baseline 2026-08-15T08:21:12.779Z–2026-08-22T08:21:12.779Z, expected ratio <= 2x, actual 2.08x, recent avg P99 2187ms over 1439 requests vs baseline avg P99 1051ms over 3510 requests. Diff proof shows this PR does not touch ProjectData/alarm/scheduled paths, and a bounded post-deploy object-only recheck passed, so causality points to pre-existing/current-staging telemetry; the official gate remains red until waiver or remediation.

No sweep/cron/alarm candidate-selection logic is changed by this PR. The DO wall-time check itself is a live analytics gate, not a candidate-selection change.

Staging Verification (REQUIRED for all code changes — merge-blocking)

All checkboxes below are mandatory for any PR that changes runtime code (.ts, .tsx, .go, etc.). Write N/A: docs-only ONLY if the PR contains zero runtime code changes. See .claude/rules/13-staging-verification.md.

• Staging deployment green — Deploy Staging workflow run 32627169272 passed for exact head 6da7ed53ecb03fe1aba7ec2fbc4da15a6ce52ada
• Live app verified via Playwright/API session reuse — logged into app.sammy.party (staging) using the saved primary session; dashboard/API smoke passed
• Existing workflows confirmed working — dashboard/session/API smoke passed; node management-proxied diagnostics/logs/events/exports/WebSocket canary passed
• New feature/fix verified on staging — GHCR, Quay, registry.k8s.io, Docker Hub, digest-pinned bypass, and unsafe registry deny probes passed. Docker Hub prior 429 was rechecked on the unchanged deployed head and classified as transient upstream rate-limit state; see evidence below.
• Infrastructure verification completed — real staging VM/node/workspaces were provisioned for the diagnostics canary and cleaned up; no production teardown was run
• Mobile and desktop verification notes added for UI changes

Staging Verification Evidence

Current exact-head evidence:

• Successful staging deploy: run 32627169272, branch sam/mega-security-hardening-1885-1887, head 6da7ed53ecb03fe1aba7ec2fbc4da15a6ce52ada; jobs Validate Configuration, Deploy to Cloudflare, and smoke-tests succeeded. No further same-head deploy should be triggered unless code/config changes.
• GitHub checks for PR Integrate security hardening PRs 1885, 1886, 1887 #1888 head 6da7ed53ecb03fe1aba7ec2fbc4da15a6ce52ada are terminal green with expected skips for non-applicable visual/CLI/devcontainer/go-vuln-diff jobs.
• Browser/API smoke: staging app loads to /dashboard; primary superadmin session valid; /api/agents lists enabled Claude Code, Codex, and OpenCode; platform Hetzner cloud-provider credential 01KNY6DC06C9QCYQM0389NAGNT is enabled; health response shape is stable.
• Node diagnostics canary: two workspaces 01M0PVJC0EZ16PRSZEVAZF1HVV and 01M0PVX8SZ49RQDKXR8B222DF3 ran on node 01M0PVJBHTJ06Z9Z87RXTZS2GT; management-proxied system-info, events, logs, containers, events/export, metrics/export, and logs WebSocket passed; both workspaces and the node were deleted. Direct raw VM fetch was unreachable rather than observable as HTTP 401/403, so local/structural auth tests remain the direct-denial evidence.
• Image resolver live probes: GHCR, Quay, registry.k8s.io, digest-pinned bypass, loopback/userinfo/link-local/ambiguous-port deny cases behaved as expected and release count stayed zero. Docker Hub was rechecked without any code/config change or additional deploy: docker.io/library/hello-world:latest and docker.io/library/busybox:latest both reached 400 MANIFEST_VALIDATION_FAILED at the deployed release endpoint with release count still zero, proving Docker Hub tag resolution completed. Direct Docker Hub challenge/token/manifest flow for hello-world returned manifest 200, digest sha256:5dd0d3e6e255913fc30f90b9f2b1d359cc2cbdb48090cc4b65f1676e203243cc, ratelimit-limit: 100;w=3600, ratelimit-remaining: 98;w=3600, docker-ratelimit-source: 135.181.47.172, and no Retry-After; bearer token/realm were redacted. No Docker Hub staging/test credential exists by workspace env name or GitHub repo/staging secret/variable name, so authenticated Docker Hub probing was not available. Prior Docker Hub 429 evidence is therefore classified as transient upstream rate-limit state on the same deployed head, not a 6da7ed53 code/config regression.
• Official DO wall-time gate remains red as described above. Bounded post-deploy object-only check passed and diff proof shows no ProjectData/alarm/scheduled path changes, but this is not a waiver.
• Three-provider real-agent matrix completed through the primary staging session using accessible primary project 01KTKXZ4ZZAT6MJFXRW1ZTQ7RB and prompts that required each provider to clone/inspect https://github.com/raphaeltm/simple-agent-manager read-only. Direct target-project membership path remains documented: target project 01KPKHSS72Q5JW01WFA7FGW2AN is owned by system_anonymous_trials; primary user has no membership; supported member API requires existing access; raw D1 and Wrangler minimal project_members insert attempts were denied by Cloudflare permissions. Matrix evidence: Claude Code task 01M0PX94K8JKZ8K6TKHRDTDF14, session 3ff5a646-fd7b-4ed3-a1ad-57e30e961ec8, workspace 01M0PXFMYNATKK1CP728XXRXHH, node 01M0PX9ANYAMQBNGYNHQ3Z296H, agent session 01M0PXGHWTB1EX9H25HDN7X4YQ; response cited apps/api/src/services/image-resolver.ts, apps/api/src/routes/nodes.ts, packages/vm-agent/internal/server/events.go, scripts/deploy/workflow-resource-names.mjs, and .github/workflows/deploy-reusable.yml. Codex task 01M0PXPE3M2X5MTXS65H6TFRY2, session 2cb287a1-18ea-4dd8-9695-83dd5497cf94, workspace 01M0PXVP3W8HW66KY63VM81ZSB, node 01M0PXPKQZ9E04Z83PEXC20130; response cited apps/api/src/services/image-resolver-outbound.ts, apps/api/src/routes/deployment-release-image-resolver.ts, apps/api/src/routes/nodes.ts, packages/vm-agent/internal/server/events.go, .github/workflows/deploy-reusable.yml, .github/workflows/teardown.yml, and workflow tests. OpenCode task 01M0PY3M6SH299ETB7X0Q7XHKZ, session ed7d2631-6fda-4326-84a7-7acd62ee2a97, workspace 01M0PYBWNAG2549Y8RGB329HP7, node 01M0PY3SWRJT9CK8DH80V0Y85T; response cited apps/api/src/services/image-resolver.ts, apps/api/src/routes/deployment-release-image-resolver.ts, apps/api/src/routes/nodes.ts, apps/api/src/services/node-agent-diagnostics.ts, apps/api/src/routes/projects/compose-publish-release-callback.ts, apps/api/src/services/node-agent.ts, and apps/api/src/services/strict-node-deletion.ts. All three reached persisted session/task/workspace paths and coherent repo-grounded responses; each workspace/node was deleted before the next provider; final staging cleanup returned nodes 0, workspaces 0. Caveat: after explicit cleanup, the linked conversation-mode task rows can show failed / workspace_missing; the persisted sessions and responses remain intact and final reviewers accepted this as a cleanup side effect, not a provider-response failure.
• Cleanup evidence: final GET /api/nodes count 0; final GET /api/workspaces?limit=100 returned no active visible workspaces; target project membership still only contains system_anonymous_trials owner.

Remaining merge blockers: #1887 live head drift from pinned head and official DO wall-time red/waiver absent. Provider matrix is completed through primary-session real workflows with direct target-repo clone prompts; target-project temporary membership attempts remain documented as unavailable due API/D1 permissions.

UI Compliance Checklist (Required for UI changes)

• Mobile-first layout verified
• Accessibility checks completed
• Shared UI components used or exception documented
• Playwright visual audit run locally — mock data scenarios (normal, long text, empty, many items, error, special chars) tested at mobile (375x667) and desktop (1280x800); no horizontal overflow; screenshots in .codex/tmp/playwright-screenshots/ (see `.claude/rules/17-ui-visual-testing.md)

N/A: no UI files or UI behavior changed. Staging browser checks are still required for release smoke.

End-to-End Verification (Required for multi-component changes)

• Data flow traced from user input to final outcome with code path citations (see .claude/rules/10-e2e-verification.md)
• Capability test exercises the complete happy path across system boundaries
• All spec/doc assumptions about existing behavior verified against code (not just "read the code")
• If any gap exists between automated test coverage and full E2E, manual verification steps documented below

Data Flow Trace

• Workflow hardening: GitHub workflow inputs/env values flow through .github/workflows/* into scripts/deploy/workflow-resource-names.mjs, which validates resource names before shell use. Structural tests in scripts/quality/deployment-workflow-hardening.test.ts reject direct ${{ }} shell interpolation.
• Node diagnostics: control-plane API routes in apps/api/src/routes/nodes.ts mint node-management tokens and proxy diagnostics to VM-agent endpoints in packages/vm-agent/internal/server/events.go; workspace-scoped credentials are rejected at the VM-agent boundary. Tests cover logs, events, exports, and WebSocket access.
• Image resolution: deployment release routes call apps/api/src/routes/deployment-release-image-resolver.ts, which uses apps/api/src/services/image-resolver.ts and apps/api/src/services/image-resolver-outbound.ts for bounded registry fetches, redirect validation, token-realm validation, and digest/tag handling. Env limits are declared in apps/api/src/env.ts, documented in apps/api/.env.example and apps/www/src/content/docs/docs/reference/configuration.md, and now propagated by scripts/deploy/sync-wrangler-config.ts plus .github/workflows/deploy-reusable.yml.

Untested Gaps

Pending staging validation:

• real node-wide diagnostics through the deployed control-plane and VM-agent;
• two-workspace canary with no cross-workspace leakage;
• official DO wall-time gate remains red pending waiver/remediation.

Post-Mortem (Required for bug fix PRs)

What broke

This PR aggregates three accepted security hardening bug-fix PRs and includes one additional release-blocker fix discovered during integration review: documented image-resolution limit env vars were not propagated through normal deployment config generation.

Root cause

The resolver env declarations/docs were updated in the constituent work, but the deploy-time Worker config sync allowlist and reusable deploy workflow env blocks did not include the new DEPLOYMENT_IMAGE_RESOLVE_* variables.

Class of bug

Configuration propagation gap across code, docs, and deployment workflow.

Why it wasn't caught

Resolver unit tests validated runtime parsing and behavior, but there was no structural test proving every documented resolver limit reached generated Worker vars through the deploy workflow.

Process fix included in this PR

Added regression coverage in scripts/quality/sync-wrangler-config.test.ts and scripts/quality/deploy-reusable-workflow.test.ts.

Post-mortem file

This PR body records the integration post-mortem. No separate post-mortem file was added to avoid unrelated durable artifacts in this release mega diff.

Specialist Review Evidence (Required for agent-authored PRs)

If local subagents were used during Phase 5, list every reviewer below. Do NOT merge until every row shows PASS or ADDRESSED. If any reviewer could not complete (timeout, workspace killed, error), you MUST add the needs-human-review label and stop — do not self-merge. See .claude/rules/25-review-merge-gate.md.

• All local reviewers completed and findings addressed before merge
• If any reviewer did NOT complete: needs-human-review label added and merge deferred to human

Reviewer	Status	Outcome
Gibbs security/implementation review (01a02d2d-92e1-7fc0-9208-a515a70ea23c)	PASS	No critical/high/medium findings. One LOW console-only teardown summary label issue noted; non-functional and not release-blocking.
Hypatia test-quality/release-matrix review (01a02d2d-d4d7-73f2-881f-01a7fff9dca2)	ADDRESSED	Found HIGH missing deployment propagation for DEPLOYMENT_IMAGE_RESOLVE_*; fixed in 657530de with deploy workflow/config tests.
Anscombe security/implementation fix review (01a02da1-e58e-73b3-9eba-3c0fc0cb03ea)	PASS	Re-reviewed 6da7ed53 receiver-preservation fix before redeploy; no changes required.
Bacon test-quality fix review (01a02da1-fbec-7462-bd30-087f333dbb1f)	PASS	Re-reviewed receiver-preservation test before redeploy; confirmed it would fail on the old unbound-fetch implementation.
Carver security/implementation fix review (01a02dc3-8a17-7d63-86ab-b1fb39d14e1c)	PASS	Fresh post-redeploy review of 6da7ed53: no release-blocking findings; Docker Hub 429 treated as product reliability follow-up, not a security bypass.
Kepler test-quality/release-matrix fix review (01a02dc3-9ff6-7b53-92c4-cb9ee09ede74)	ADDRESSED	Fix-specific test passes. Earlier live release-readiness concerns were addressed by exact-head Docker Hub endpoint probes and completed Claude/Codex/OpenCode matrix evidence; official DO wall-time and #1887 head drift remain explicit release blockers outside this row.
Bohr final security/implementation review (01a02de9-9c38-7581-8e08-544f5f1ebc84)	PASS	Code security/implementation PASS; accepted provider matrix as non-blocking. Release remains blocked only on #1887 head drift and official DO wall-time/waiver.
Parfit final test-quality/release-matrix review (01a02de9-9efa-78f2-8a2e-8af87542fc9c)	PASS	Accepted provider matrix real-response requirement, receiver-preservation test, Docker Hub non-regression, and cleanup; noted post-cleanup task workspace_missing caveat. Release remains blocked only on #1887 head drift and official DO wall-time/waiver.

Exceptions (If any)

• Scope: Added release-blocker fixes beyond the exact constituent union in scripts/deploy/sync-wrangler-config.ts, scripts/quality/sync-wrangler-config.test.ts, apps/api/src/services/image-resolver.ts, and apps/api/tests/unit/image-resolver.test.ts.
• Rationale: Required to make the documented resolver work/size limits deployable and to make live Cloudflare Workers fetch behavior preserve host-function receiver semantics.
• Expiration: This exception is resolved by the included fix and tests; no runtime deferral.

Agent Preflight (Required)

• Preflight completed before code changes

Classification

• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

N/A: no external API behavior was changed. This work integrates already accepted repository PRs and validates local SAM/Cloudflare Worker deployment, VM-agent, and registry resolver code paths against repository tests and project release policy.

Codebase Impact Analysis

Affected paths include .github/workflows/* deploy/teardown/restore/provision workflows, scripts/deploy/*, scripts/quality/*, apps/api/src/routes/deployment-*, apps/api/src/services/image-resolver*, apps/api/src/routes/nodes.ts, packages/vm-agent/internal/server/events.go, apps/api/tests/unit/*, packages/vm-agent/internal/server/events_test.go, apps/www/src/content/docs/docs/reference/*, and specs/*/contracts/*.

Documentation & Specs

Docs/specs updated in apps/www/src/content/docs/docs/reference/configuration.md, apps/www/src/content/docs/docs/reference/vm-agent.md, specs/014-multi-workspace-nodes/contracts/node-agent-api.md, and specs/020-node-observability/contracts/vm-agent-logs.md.

Constitution & Risk Check

Checked Principle XI / no hardcoded operational values: the new resolver work/size limits are configurable via env, documented, and now propagated through deployment. Key risks are staging-only until verified: live Worker DNS/rebinding behavior, node-wide diagnostics auth boundaries, registry redirect/token-realm fail-closed behavior, and three-provider real-agent workflow continuity.

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing sam/mega-security-hardening-1885-1887 (6da7ed5) with main (b672af2)}

[sonarqubecloud]

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.1% Duplication on New Code

See analysis details on SonarQube Cloud