security: document localhost=full-trust boundary and auto-approve/inheritance risks #414

New issue

Open

opened 2026-07-21 00:06:13 +02:00 by dries · 0 comments

dries commented

2026-07-21 00:06:13 +02:00

Owner

Findings #3, #4, #5 (Low / by-design) from a security review. These are inherent to the design rather than bugs; the ask is to document the trust model clearly so operators do not misconfigure.

Items to document (docs/configuration.md and/or docs/mcp.md)

#3 Local-process trust: isPrivilegedRequest treats any loopback + Origin-less request as privileged (by design, for CLI/MCP clients). Any local process — or a prompt-injected agent — can drive new_session, worktree creation, tmux/opencode launch, and workflow command nodes. The trust boundary is "everything on this machine". Ref: internal/server/middleware.go:140, internal/mcp/server.go.
#4 Auto-approve is prompt-injection-exposed: the LLM judge sees attacker-influenceable session content and auto-replies to permission prompts. Safe-command cache + scoped judge are the only guardrails. Combined with #101 permission inheritance, an approved/YOLO posture propagates to child sessions. Ref: internal/autoapprove.
#5 Reverse-proxy footgun: a plain same-host reverse proxy makes ALL clients appear as loopback, so Origin-less clients bypass auth on privileged routes. Ref: internal/server/middleware.go:112-121.

Acceptance

docs/configuration.md gains a "Security model / trust boundary" section covering: localhost = full trust, do not front with an unauthenticated reverse proxy, and the auto-approve/inheritance caveats.

Findings #3, #4, #5 (Low / by-design) from a security review. These are inherent to the design rather than bugs; the ask is to document the trust model clearly so operators do not misconfigure. ## Items to document (docs/configuration.md and/or docs/mcp.md) - **#3 Local-process trust:** `isPrivilegedRequest` treats any loopback + Origin-less request as privileged (by design, for CLI/MCP clients). Any local process — or a prompt-injected agent — can drive `new_session`, worktree creation, tmux/opencode launch, and workflow *command nodes*. The trust boundary is "everything on this machine". Ref: `internal/server/middleware.go:140`, `internal/mcp/server.go`. - **#4 Auto-approve is prompt-injection-exposed:** the LLM judge sees attacker-influenceable session content and auto-replies to permission prompts. Safe-command cache + scoped judge are the only guardrails. Combined with #101 permission inheritance, an approved/YOLO posture propagates to child sessions. Ref: `internal/autoapprove`. - **#5 Reverse-proxy footgun:** a plain same-host reverse proxy makes ALL clients appear as loopback, so Origin-less clients bypass auth on privileged routes. Ref: `internal/server/middleware.go:112-121`. ## Acceptance - docs/configuration.md gains a "Security model / trust boundary" section covering: localhost = full trust, do not front with an unauthenticated reverse proxy, and the auto-approve/inheritance caveats.