fix: security hardening across all layers (#35)

* fix: comprehensive security hardening across all layers

Critical:
- Replace --dangerously-skip-permissions with explicit tool allowlist
  via settings.json (Claude Code bridge)
- Constant-time token comparison (subtle crate) in web auth and
  orchestrator auth to prevent timing attacks

High:
- Revoke tokens and clean up handles on container creation failure
- Drop SETUID/SETGID capabilities from containers (keep only CHOWN)
- Disable redirect following in HTTP tool and WASM wrapper (SSRF)
- Reject URL userinfo (@) in WASM allowlist parser (host confusion)
- Fix binary body bypassing leak detection (from_utf8 -> from_utf8_lossy)
- Protect identity files from LLM overwrites (prompt injection defense)
- Prevent tool shadowing: built-in tools cannot be replaced dynamically
- User-scoped job APIs: list/detail/cancel/restart/prompt/events/files
- CORS restricted to localhost origins, WebSocket origin validation
- Sandbox shell fail-closed: no silent fallback to unsandboxed execution
- Scrub secrets from log broadcaster before SSE broadcast
- XSS sanitization on rendered markdown in web UI
- WASM epoch ticker thread so timeout deadlines actually fire

Medium:
- Cap state transition history at 200 entries
- SSE/WebSocket connection limit (100 max)
- Request body size limit (1MB)
- Response body size limit enforcement in WASM HTTP
- UTF-8 safe string truncation (routine engine, shell tool)
- Fix PolicyAction::Sanitize to actually run the sanitizer
- TOCTOU fix in scheduler and context manager (hold write lock)
- Project file serving moved behind auth
- Path traversal guard on project_id
- Session file permissions set to 0600 on unix
- AtomicUsize for routine running_count (panic-safe)
- Completion detection hardened against false positives and tool injection
- Tool output no longer drives job completion (only LLM response)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: address security review findings across all layers

- Fix path traversal sandbox bypass via lexical normalization (file.rs)
- Fix SSRF via DNS rebinding with pre-request hostname resolution (http.rs)
- Add token budget enforcement on LLM calls (reasoning.rs, state.rs)
- Fix cross-user chat history leak with ownership verification (store.rs, server.rs)
- Add sliding-window rate limiter on gateway chat endpoint (server.rs)
- Harden extension install: HTTPS-only, 50MB cap, WASM magic validation (manager.rs)
- Add destructive command blocklist that overrides shell auto-approval (shell.rs)
- Add 5MB response body size cap to HTTP tool (http.rs)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* refactor: deduplicate shared helpers and remove dead code

Extract floor_char_boundary and llm_signals_completion into src/util.rs,
unifying diverging phrase lists from agent/worker.rs and worker/runtime.rs.
Remove dead RespondResult::usage(), duplicate PROTECTED_IDENTITY_FILES
constant, double LeakDetector scanning in WebLogLayer, and invalid
0.0.0.0 origin from WebSocket allow list.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: address PR review findings and CI test failures

- Fix record_failed_approve: .truncate(true) wiped the attempts file
  before reading, so failed pairing attempts never accumulated and
  rate limiting never triggered.
- Guard wizard WASM test: skip gracefully when channel build artifacts
  are absent (CI doesn't compile wasm32-wasip2 targets).
- Fix DNS rebinding check: use port 0 instead of hardcoded 443, since
  the port is irrelevant for hostname resolution.
- Remove hardcoded CORS port 3001: the dynamic addr.port() entries
  already cover the actual server port.
- Require WebSocket Origin header: reject connections that omit it
  entirely, since browsers always send Origin for WS upgrades and a
  missing header indicates a non-browser client bypassing the check.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: address second round of PR review findings

- store.rs: reintroduce file locking around read-modify-write in
  record_failed_approve (concurrent callers could clobber each other).
- sse.rs: replace load+check+fetch_add with atomic fetch_update in both
  subscribe_raw() and subscribe() to prevent overshooting max_connections.
- ws.rs: decrement WS tracker before early return when subscribe_raw()
  returns None (connection limit reached), fixing a counter leak.
- server.rs: parse WS Origin host exactly instead of prefix matching,
  preventing bypass via crafted origins like http://localhost.evil.com.
- workspace_integration.rs: skip tests gracefully when Postgres is
  unreachable instead of panicking (fixes 10 CI failures).

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: add Origin header to WS integration tests

The Origin header requirement added in a3b0190 broke the WS gateway
integration tests. Test clients now send Origin: http://127.0.0.1:{port}
to match the server's localhost validation.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

src/context/manager.rs

@@ -45,20 +45,21 @@ impl ContextManager {
         title: impl Into<String>,
         description: impl Into<String>,
     ) -> Result<Uuid, JobError> {
-        let contexts = self.contexts.read().await;
+        // Hold write lock for the entire check-insert to prevent TOCTOU races
+        // where two concurrent calls both pass the active_count check.
+        let mut contexts = self.contexts.write().await;
         let active_count = contexts.values().filter(|c| c.state.is_active()).count();
 
         if active_count >= self.max_jobs {
             return Err(JobError::MaxJobsExceeded { max: self.max_jobs });
         }
-        drop(contexts);
 
         let context = JobContext::with_user(user_id, title, description);
         let job_id = context.job_id;
+        contexts.insert(job_id, context);
+        drop(contexts);
 
         let memory = Memory::new(job_id);
-
-        self.contexts.write().await.insert(job_id, context);
         self.memories.write().await.insert(job_id, memory);
 
         Ok(job_id)

src/context/state.rs

@@ -119,6 +119,10 @@ pub struct JobContext {
     pub estimated_duration: Option<Duration>,
     /// Actual cost so far.
     pub actual_cost: Decimal,
+    /// Total tokens consumed by LLM calls in this job.
+    pub total_tokens_used: u64,
+    /// Maximum tokens allowed per job (0 = unlimited).
+    pub max_tokens: u64,
     /// When the job was created.
     pub created_at: DateTime<Utc>,
     /// When the job was started.
@@ -159,6 +163,8 @@ impl JobContext {
             estimated_cost: None,
             estimated_duration: None,
             actual_cost: Decimal::ZERO,
+            total_tokens_used: 0,
+            max_tokens: 0,
             created_at: Utc::now(),
             started_at: None,
             completed_at: None,
@@ -189,6 +195,14 @@ impl JobContext {
         };
 
         self.transitions.push(transition);
+
+        // Cap transition history to prevent unbounded memory growth
+        const MAX_TRANSITIONS: usize = 200;
+        if self.transitions.len() > MAX_TRANSITIONS {
+            let drain_count = self.transitions.len() - MAX_TRANSITIONS;
+            self.transitions.drain(..drain_count);
+        }
+
         self.state = new_state;
 
         // Update timestamps
@@ -210,6 +224,29 @@ impl JobContext {
         self.actual_cost += cost;
     }
 
+    /// Record token usage from an LLM call. Returns an error string if the
+    /// token budget has been exceeded after this addition.
+    pub fn add_tokens(&mut self, tokens: u64) -> Result<(), String> {
+        self.total_tokens_used += tokens;
+        if self.max_tokens > 0 && self.total_tokens_used > self.max_tokens {
+            Err(format!(
+                "Token budget exceeded: used {} of {} allowed tokens",
+                self.total_tokens_used, self.max_tokens
+            ))
+        } else {
+            Ok(())
+        }
+    }
+
+    /// Check whether the monetary budget has been exceeded.
+    pub fn budget_exceeded(&self) -> bool {
+        if let Some(ref budget) = self.budget {
+            self.actual_cost > *budget
+        } else {
+            false
+        }
+    }
+
     /// Get the duration since the job started.
     pub fn elapsed(&self) -> Option<Duration> {
         self.started_at.map(|start| {
@@ -274,6 +311,57 @@ mod tests {
         assert_eq!(ctx.state, JobState::Completed);
     }
 
+    #[test]
+    fn test_transition_history_capped() {
+        let mut ctx = JobContext::new("Test", "Transition cap test");
+        // Cycle through Pending -> InProgress -> Stuck -> InProgress -> Stuck ...
+        ctx.transition_to(JobState::InProgress, None).unwrap();
+        for i in 0..250 {
+            ctx.mark_stuck(format!("stuck {}", i)).unwrap();
+            ctx.attempt_recovery().unwrap();
+        }
+        // 1 initial + 250*2 = 501 transitions, should be capped at 200
+        assert!(
+            ctx.transitions.len() <= 200,
+            "transitions should be capped at 200, got {}",
+            ctx.transitions.len()
+        );
+    }
+
+    #[test]
+    fn test_add_tokens_enforces_budget() {
+        let mut ctx = JobContext::new("Test", "Budget test");
+        ctx.max_tokens = 1000;
+        assert!(ctx.add_tokens(500).is_ok());
+        assert_eq!(ctx.total_tokens_used, 500);
+        assert!(ctx.add_tokens(600).is_err());
+        assert_eq!(ctx.total_tokens_used, 1100); // tokens still recorded
+    }
+
+    #[test]
+    fn test_add_tokens_unlimited() {
+        let mut ctx = JobContext::new("Test", "No budget");
+        // max_tokens = 0 means unlimited
+        assert!(ctx.add_tokens(1_000_000).is_ok());
+    }
+
+    #[test]
+    fn test_budget_exceeded() {
+        let mut ctx = JobContext::new("Test", "Money test");
+        ctx.budget = Some(Decimal::new(100, 0)); // $100
+        assert!(!ctx.budget_exceeded());
+        ctx.add_cost(Decimal::new(50, 0));
+        assert!(!ctx.budget_exceeded());
+        ctx.add_cost(Decimal::new(60, 0));
+        assert!(ctx.budget_exceeded());
+    }
+
+    #[test]
+    fn test_budget_exceeded_none() {
+        let ctx = JobContext::new("Test", "No budget");
+        assert!(!ctx.budget_exceeded()); // No budget = never exceeded
+    }
+
     #[test]
     fn test_stuck_recovery() {
         let mut ctx = JobContext::new("Test", "Test job");