Merge pull request #36 from devswha/codex/adversarial-skills-e2e

fix: harden execution boundaries and preserve async client state

Author: devswha

.env.example

@@ -18,17 +18,20 @@ VITE_PORT=5173
 # access is not required.
 HOST=0.0.0.0
 
-# Vite host admission
-# Vite accepts localhost and IP addresses without this setting. To use a DNS
-# name, list it here with commas between names; a leading dot matches its
-# subdomains.
+# HTTP/WebSocket and Vite host admission
+# Localhost and literal IP addresses work without this setting. Other DNS
+# names require an explicit list, including HTTPS reverse proxies and tailnet
+# names. Set this in the app server's environment before upgrading an existing
+# DNS-based deployment. Use commas between names; no schemes, paths, or ports.
+# A leading dot admits that domain and its subdomains.
 #
 # ALLOWED_HOSTS=macbookpro.tail1e211e.ts.net
 # ALLOWED_HOSTS=.tail1e211e.ts.net
 # ALLOWED_HOSTS=gjc.example.com,.internal
 #
-# ALLOWED_HOSTS=* turns off this protection. Do that only on a trusted network:
-# the UI can execute commands as the server user.
+# ALLOWED_HOSTS=* disables the DNS-rebinding host protection. Prefer explicit
+# names: a hostile page can otherwise target the server through its own DNS
+# name, even when the server binds loopback. See docs/SELF-HOST.md for migration.
 
 # Optional Claude executable override.
 # CLAUDE_CLI_PATH=claude

docs/SELF-HOST.md

@@ -61,6 +61,62 @@ port forwarding.
 ssh -N -L 3001:127.0.0.1:3001 user@server
 ```
 
+## DNS host admission and reverse-proxy migration
+
+The server now rejects unlisted DNS names before serving HTTP routes or
+accepting WebSocket upgrades. With `ALLOWED_HOSTS` unset, `localhost` and
+literal IPv4/IPv6 addresses continue to work. Matching `Host` and `Origin`
+headers, an omitted `Origin`, or `X-Forwarded-Proto: https` do not admit a DNS
+name. This prevents an attacker-controlled DNS name from reaching a loopback
+server after rebinding.
+
+**Compatibility change:** older releases accepted arbitrary matching DNS
+Host/Origin pairs. Existing HTTPS reverse proxies, custom local DNS aliases
+and tailnet DNS names must now be listed in the **app server's environment**.
+Changing only Nginx's `server_name` is insufficient. Direct loopback/IP access
+and SSH tunnels using `localhost` need no migration.
+
+Before upgrading a DNS-based deployment, create a service drop-in:
+
+```sh
+systemctl --user edit gajae-app.service
+```
+
+Add a setting such as:
+
+```ini
+[Service]
+Environment="ALLOWED_HOSTS=gjc.example.com,macbook.tailnet.example"
+```
+
+Replace these examples with names you control. Entries are comma-separated
+hostnames without schemes, ports or paths. A leading dot such as
+`.internal.example` admits that domain and all its subdomains; use an exact
+name when only one host should be trusted. Source-development deployments
+can put the same setting in `.env`; both Vite and the API server use it.
+
+Keep the proxy forwarding the public Host (`proxy_set_header Host $host;` in
+the [Nginx example](nginx-subpath-template.conf)). A proxy that uses a DNS
+upstream name as Host must also list that name, or forward a loopback/IP Host;
+the public browser origin still needs its own entry. HTTPS remains supported
+with this explicit configuration. Forwarded headers do not replace admission.
+
+After the upgrade, reload the service configuration and restart the app:
+
+```sh
+systemctl --user daemon-reload
+systemctl --user restart gajae-app.service
+curl --fail http://127.0.0.1:3001/health
+```
+
+Check the published page and its WebSocket connection. HTTP requests with an
+unlisted Host return 403; WebSocket upgrades are rejected with 401. Configure
+health checks using a permitted Host.
+
+`ALLOWED_HOSTS=*` retains an explicit compatibility escape hatch, but disables
+this DNS host protection. Host admission does not authenticate remote clients;
+keep the existing loopback/VPN/tunnel or authenticated-proxy access boundary.
+
 ## Cutover to a verified release
 
 A cutover changes only the `current` symlink and then restarts the service.

docs/V2-SESSION-HANDOFF.md

@@ -1,6 +1,6 @@
 # gajae-app v2 — Session Handoff (resume state)
 
-Last updated: 2026-09-05 (parallel correctness review and follow-up status). Supersedes the 2026-07-18 handoff.
+Last updated: 2026-09-05 (adversarial review and nine-skill live acceptance). Supersedes the 2026-07-18 handoff.
 
 ## TL;DR
 
@@ -474,6 +474,14 @@ after the reconcile fetch replaces realtime timestamps with disk ones.
 
 ## Current follow-ups (rechecked 2026-09-05)
 
+- The subsequent adversarial pass and all nine live skill outcomes are in
+  [`plans/adversarial-skills-e2e-2026-09-05.md`](plans/adversarial-skills-e2e-2026-09-05.md).
+  DNS deployments now require explicit `ALLOWED_HOSTS`; see `SELF-HOST.md`.
+  The app avoids the SDK workflow-ID defect by omitting the redundant explicit
+  provider ID, and restores skill requests from transcript metadata. Delegation
+  remains disabled because an offline real-SDK test proved that children bypass
+  their parent's permission policy. Research/file artifacts do not mean that
+  `ralplan`, `ultragoal` or the autoresearch goal lifecycle completed.
 - The parallel correctness pass is recorded in
   [`plans/code-review-2026-09-05.md`](plans/code-review-2026-09-05.md), including
   session/queue isolation, transcript turns and transport, scratch startup,
@@ -482,16 +490,20 @@ after the reconcile fetch replaces realtime timestamps with disk ones.
   start, and runtime edit-result diffs have shipped. The older unchecked
   public-distribution checklist in `V2-PLAN.md` is historical; signed and
   notarized beta.7/beta.8 images were already published on September 3.
-- **PR #30 / issue #18 remain blocked on the upstream SDK release.** The npm
+- **PR #30 still awaits the upstream SDK accessor fix.** The npm
   registry still reports `@gajae-code/coding-agent` latest `0.16.3`, which
   predates the workflow identity fix (`Yeachan-Heo/gajae-code#5282`, merged
   into `dev` at `2250239de9e565df2d3cb12ba365d65ff9f0555d`). Keep the existing
   `0.15.6` app pin until a published runtime carries that change, then finish
-  the prepared regression test, manifest and dependency updates in #30.
-- **Issue #3 needs its skill matrix re-run after #30.** The bundled `gjc`
+  the prepared regression test, manifest and dependency updates in #30. The
+  app's redundant-ID workaround now removes the observed issue #18 trigger;
+  it does not make the draft's direct SDK accessor contract pass.
+- **Issue #3 now has a live matrix, with unresolved capability blockers.** The bundled `gjc`
   shim is already in the app; the issue's older "shim in progress" comment
-  is no longer current. Do not close the workflow issue based only on
-  transport tests or on successful skill selection.
+  is no longer current. Nine skills were actually invoked, including user
+  skills. The interview produced its pending-approval spec; mandatory
+  delegation and goal-mode restrictions still prevent complete execution of
+  the other bundled workflows. Keep #3 open for those recorded limitations.
 - **CI signing awaits owner-provided credentials.** `gh secret list --env
   release` returned no environment secrets on September 5. The workflow
   and the five required names are documented in

docs/nginx-subpath-template.conf

@@ -9,6 +9,10 @@
 # location and rewrite together. The client currently keeps /api/, /ws, /shell
 # and /health at the site root, so they remain separately proxied.
 #
+# When publishing a DNS hostname, set ALLOWED_HOSTS to that hostname in the
+# app server's environment. HTTPS and server_name alone do not admit it;
+# see SELF-HOST.md for the migration from implicit same-host admission.
+#
 # Directives are scoped to the routes that need them: Accept-Encoding is
 # stripped only where sub_filter must read plaintext, upgrade headers travel
 # only on WebSocket-capable routes, and /health keeps the default timeouts.