fix(cloud): close P0/P1 audit findings (agent auth, SSRF, reliability)

[mohabbis]

Summary

Closes the actionable P0/P1 findings from cloud/docs/ARCHITECTURE_DECISIONS.md that do not need a product redesign.

Trust & safety

• Touches files / filesystem mutation: none

• Touches OS input: none

• Touches screenshots / screen contents: yes — skips screenshot capture for fill steps marked sensitive so OTP/card pixels never hit the artifact store

• Touches network: yes — navigate URLs are checked against a public-URL policy (blocks cloud metadata + RFC1918; loopback allowed for fixtures; other private hosts only if they match APP_URL)

• Touches authentication / secrets: yes — /api/agent/* is bearer-only (session cookies refused); Auth.js routes are rate-limited; minting agent credentials requires OWNER/ADMIN

• Touches app / window state: none

• Risky actions remain deny-by-default

• No silent delete or silent overwrite

• Experimental features stay gated / out of scope

Changes

• P0-1: resolveAgentPrincipal refuses session cookies — agents must use a minted API key
• P0-3: Rate-limit Auth.js GET/POST via the existing Redis limiter (MFA/invite/audit already covered)
• P1-5 (partial): Minting agent credentials is OWNER/ADMIN only
• P1-6 (partial): checkPublicHttpUrl + author-time (authoredSteps) and runtime (applyStep) enforcement
• P1-7: Each BullMQ Worker gets its own Redis connection
• P1-8: GHOST_RUN_TIMEOUT_MS wall-clock budget (default 30m); heartbeat stops renewing past deadline
• P1-2 (partial): No screenshots for sensitive fills
• P1-11 + build race: scripts/require-test-env.mjs gates pnpm test; @ghost/core test depends on build
• Docs: audit table in ARCHITECTURE_DECISIONS.md updated with status

Still open (need design): P1-1 checkpointed audit verify, P1-3/P1-4 secret refs + journal redaction, full P1-5 VIEWER/APPROVER roles, P1-9 per-org fairness, DNS-rebinding / --no-sandbox.

Validation

• cd cloud && pnpm typecheck
• cd cloud && pnpm test — core 241, web 115, worker 120, mcp 1 (all passed; local Postgres+Redis)
• cd cloud && pnpm build

Risks / follow-up

• Members can no longer mint agent API keys; Settings UI should surface the 403 clearly (admin-only).
• Local pnpm test without DB now fails unless GHOST_ALLOW_SKIP_DB_TESTS=1.
• Loopback navigate remains allowed so fixtures/e2e keep working; RFC1918 still blocked unless it matches APP_URL.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ghost	Ready	Preview	Aug 10, 2026 6:49am

[chatgpt-codex-connector]

💡 Codex Review

ghost/cloud/apps/worker/src/browser/driver.ts

Lines 106 to 107 in 52d6f43

	assertPublicHttpUrl(step.url);
	await page.goto(step.url, { waitUntil: "domcontentloaded", timeout });

Validate every redirect before navigation

When an allowed public URL responds with a redirect to 169.254.169.254 or an RFC1918 host, assertPublicHttpUrl approves only the initial URL and page.goto follows the redirect without another policy check; a subsequent extract step can therefore still read the private response. Enforce the policy on every browser request/redirect, including restore navigation, rather than only before the initial goto.

AGENTS.md reference: AGENTS.md:L203-L206

---

ghost/cloud/apps/worker/src/browser/driver.ts

Lines 232 to 233 in 52d6f43

	export function shouldCaptureScreenshot(step: WorkflowStep): boolean {
	return !(step.type === "fill" && step.sensitive);

Keep screenshots suppressed after sensitive fills

When a sensitive fill is followed by any ordinary step while the value remains visible, only the fill's screenshot is skipped; the next click, waitFor, or verify calls runStep again and captures the same page, persisting the secret. The updated driver test itself fills a card number and then immediately takes a screenshot during the click, so suppression must remain active until the sensitive field is cleared, obscured, or the page changes.

AGENTS.md reference: AGENTS.md:L201-L201

---

ghost/cloud/apps/worker/src/jobs/runWorkflow.ts

Lines 166 to 168 in 52d6f43

	const heartbeat = setInterval(() => {
	if (Date.now() >= runDeadline) return;
	void prisma.run

Abort in-flight work when the run deadline expires

When a step is still awaited at the deadline—for example, an unbounded waitFor.ms or a browser action whose timeout extends past the remaining run budget—the heartbeat stops here but the browser operation is not canceled, and the loop cannot raise RUN_TIMEOUT until that operation returns. This still allows a run to wedge the worker indefinitely and eventually lets the expired lease be reclaimed while the original executor remains active; the deadline needs to interrupt and close the in-flight browser work before lease renewal stops.

---

ghost/cloud/scripts/require-test-env.mjs

Lines 15 to 16 in 52d6f43

	const required = ["DATABASE_URL", "REDIS_URL", "GHOST_SESSION_KEY"];
	const missing = required.filter((k) => !process.env[k]?.trim());

Load cloud/.env before enforcing the test prerequisites

When a developer follows the emitted instruction and copies .env.example to cloud/.env (including via pnpm demo) without exporting those variables into the shell, this guard still reports all three as missing because Node does not load .env automatically and the check runs before Turbo or package-level environment loaders. Consequently the documented local pnpm test path always exits 1; load the cloud env file before checking or invoke the guard with an explicit env-file loader.

---

ghost/cloud/apps/web/src/app/api/auth/[...nextauth]/route.ts

Line 27 in 52d6f43

const result = await rateLimit(`${key}:${clientKey(req)}`, { limit, windowSeconds });

Derive auth rate-limit keys from a trusted client address

When the supported Node deployment is exposed directly or sits behind a proxy that preserves or appends a caller-supplied X-Forwarded-For, clientKey(req) trusts the first entry, so an attacker can rotate that header on every /api/auth/* POST and receive a fresh 20-attempt bucket each time. This leaves the sign-in brute-force path effectively unbounded outside proxies such as Vercel that overwrite the header; derive the key from trusted platform metadata or normalize forwarding headers at a trusted proxy boundary.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".