From d6061fda8ac27ce90c322209a4d3b2fda0d5aec7 Mon Sep 17 00:00:00 2001 From: "[._.]/ Adam Eivy" Date: Tue, 1 Sep 2026 18:31:37 +0000 Subject: [PATCH] docs: remove outdated security audit archive and update documentation indexes --- README.md | 4 +-- docs/README.md | 3 +- docs/SECURITY_AUDIT.md | 54 ------------------------------- docs/features/product-surfaces.md | 4 +-- 4 files changed, 5 insertions(+), 60 deletions(-) delete mode 100644 docs/SECURITY_AUDIT.md diff --git a/README.md b/README.md index 0d6f7fcf2b..9e1654a640 100644 --- a/README.md +++ b/README.md @@ -344,7 +344,7 @@ PortOS binds to `0.0.0.0` so you can access it from any device on your Tailscale - Check logs and restart services from your phone - View dashboard on your tablet while coding on your laptop -> **Security Note**: PortOS is designed for private Tailscale networks. Do not expose ports 5553-5561 to the public internet. An optional instance password (*Settings → Security*) gates `/api/*` and `/data/*` if you want a second layer, but it is **off by default** — the tailnet is the trust boundary. See the [Security Audit](./docs/SECURITY_AUDIT.md) for hardening details. +> **Security Note**: PortOS is designed for private Tailscale networks. Do not expose ports 5553-5561 to the public internet. An optional instance password (*Settings → Security*) gates `/api/*` and `/data/*` if you want a second layer, but it is **off by default** — the tailnet is the trust boundary. See the Security Model in [AGENTS.md](./AGENTS.md#security-model) and the [Setup Guide](./docs/SETUP.md) for network and authentication details. ## Tech Stack @@ -426,7 +426,6 @@ Full catalog (including design plans, ADRs, and research notes): [docs/README.md - [GitHub Actions](./docs/GITHUB_ACTIONS.md) — CI/CD workflow patterns - [Versioning & Releases](./docs/VERSIONING.md) — Semantic versioning and release process - [Dependency Audit](./docs/DEPS.md) — Every third-party dependency and why it stays -- [Security Audit](./docs/SECURITY_AUDIT.md) — Historical hardening audit (2026-02, 10/10 items resolved) - [Troubleshooting](./docs/TROUBLESHOOTING.md) — Common issues and solutions ### Feature Deep Dives @@ -438,6 +437,7 @@ Full catalog (including design plans, ADRs, and research notes): [docs/README.md - [Agent Tools (MCP)](./docs/features/agent-context.md) — Loopback-only bounded context plus independently granted semantic PortOS tools for local CoS agents - [Agent Skills](./docs/features/agent-skills.md) — Task-type-specific agent prompts - [Claude on Ollama](./docs/features/claude-ollama.md) — Run agent tasks on a local model +- [Fleet LLM Host](./docs/features/fleet-llm-host.md) — Dedicated GPU host serving OpenAI-compatible models to a PortOS fleet - [CoS Agent Runner](./docs/features/cos-agent-runner.md) — Isolated agent process architecture - [CoS Enhancement](./docs/features/cos-enhancement.md) — Hybrid search, proactive execution, error recovery - [MTPLX](./docs/features/mtplx.md) — Native multi-token-prediction Qwen runtime on Apple Silicon, managed as a PM2 process from Models → LLMs diff --git a/docs/README.md b/docs/README.md index 4d9296f5d8..69fb2967e9 100644 --- a/docs/README.md +++ b/docs/README.md @@ -31,7 +31,6 @@ Index of everything under `docs/`. Start with the [root README](../README.md) fo | [WINDOWS_CONSOLE.md](./WINDOWS_CONSOLE.md) | Why console windows flash and steal focus on Windows, and the two fixes | | [GOALS_OPERATIONAL.md](./GOALS_OPERATIONAL.md) | Runtime operating principles the CoS agent reads (parsed by `goalProgress.js`) | | [METRICS.md](./METRICS.md) | The `METRICS.md` convention — how a managed app exposes its own success metrics so agents (incl. Layered Intelligence) can evaluate it against its goals | -| [SECURITY_AUDIT.md](./SECURITY_AUDIT.md) | Historical hardening audit (2026-02, all items resolved) | ## Feature deep dives (`features/`) @@ -39,7 +38,7 @@ Start with the [product surface map](./features/product-surfaces.md) for a compl App management: [app-wizard](./features/app-wizard.md) · [autofixer](./features/autofixer.md) · [browser](./features/browser.md) · [error-handling](./features/error-handling.md) · [jira-sprint-manager](./features/jira-sprint-manager.md) -Chief of Staff: [chief-of-staff](./features/chief-of-staff.md) · [cos-agent-runner](./features/cos-agent-runner.md) · [cos-enhancement](./features/cos-enhancement.md) · [agent-context](./features/agent-context.md) · [agent-skills](./features/agent-skills.md) · [memory-system](./features/memory-system.md) · [claude-ollama](./features/claude-ollama.md) · [mtplx](./features/mtplx.md) · [dflash2](./features/dflash2.md) ([DSpark vs DFlash 2](./research/2026-08-19-dspark-vs-dflash2.md)) · [qwen38-rtx3090](./features/qwen38-rtx3090.md) ([3090 bring-up](./research/2026-08-21-qwen38-rtx3090-vllm.md)) · [sglang-qwen38](./features/sglang-qwen38.md) ([SGLang Hopper/Blackwell evaluation](./research/2026-08-21-sglang-qwen38-27b.md)) · [prompt-manager](./features/prompt-manager.md) +Chief of Staff: [chief-of-staff](./features/chief-of-staff.md) · [cos-agent-runner](./features/cos-agent-runner.md) · [cos-enhancement](./features/cos-enhancement.md) · [agent-context](./features/agent-context.md) · [agent-skills](./features/agent-skills.md) · [memory-system](./features/memory-system.md) · [claude-ollama](./features/claude-ollama.md) · [fleet-llm-host](./features/fleet-llm-host.md) · [mtplx](./features/mtplx.md) · [dflash2](./features/dflash2.md) ([DSpark vs DFlash 2](./research/2026-08-19-dspark-vs-dflash2.md)) · [qwen38-rtx3090](./features/qwen38-rtx3090.md) ([3090 bring-up](./research/2026-08-21-qwen38-rtx3090-vllm.md)) · [sglang-qwen38](./features/sglang-qwen38.md) ([SGLang Hopper/Blackwell evaluation](./research/2026-08-21-sglang-qwen38-27b.md)) · [prompt-manager](./features/prompt-manager.md) Identity & self: [digital-twin](./features/digital-twin.md) · [identity-system](./features/identity-system.md) · [soul-system](./features/soul-system.md) · [privacy-center](./features/privacy-center.md) · [post](./features/post.md) (insights design spike: [plans/2026-06-03](./plans/2026-06-03-cross-domain-insights-engine.md)) diff --git a/docs/SECURITY_AUDIT.md b/docs/SECURITY_AUDIT.md deleted file mode 100644 index 86a057b929..0000000000 --- a/docs/SECURITY_AUDIT.md +++ /dev/null @@ -1,54 +0,0 @@ -# Security Hardening Audit (2026-02-19) - -> **Historical record.** This is a point-in-time audit from February 2026 (v1.14 era, before the PostgreSQL migration). It is kept as a record of the hardening pass, not maintained as a living document. - -PortOS is an internal/VPN app so auth, CORS, rate limiting, and HTTPS are out of scope. These items address real bugs, crash risks, and secret leaks that matter regardless of network posture. - -**Status: All 10 items resolved.** - -## S1: Patch npm dependency CVEs ✅ - -- All actionable CVEs resolved -- Remaining: 1 low-severity pm2 ReDoS (GHSA-x5gf-qvw8-r2rm, CVSS 4.3) — no fix published by maintainers, not exploitable via PortOS routes -- Client: 0 vulnerabilities - -## S2: Sanitize provider API responses ✅ - -- `sanitizeProvider()` in `server/routes/providers.js` strips `apiKey`, redacts `secretEnvVars` values to `'***'`, returns `hasApiKey: boolean` -- All GET endpoints use sanitization - -## S3: Whitelist env vars in PTY shell spawn ✅ - -- `buildSafeEnv()` in `server/services/shell.js` uses `SAFE_ENV_PREFIXES` allowlist — no `...process.env` spread - -## S4: Fix mutex lock bug + extract shared utility ✅ - -- `createMutex()` in `server/lib/asyncMutex.js` with proper `try/finally` -- Used by both `cos.js` and `memory.js` - -## S5: Add Zod validation to Socket.IO events ✅ - -- `server/lib/socketValidation.js` has Zod schemas for all socket events -- `validateSocketData()` helper used in `socket.js` - -## S6: Sanitize error context in Socket.IO broadcasts ✅ - -- `sanitizeContext()` in `server/lib/errorHandler.js` strips sensitive fields (apikey, token, secret, password, etc.) with circular-reference protection - -## S7: Guard unprotected JSON.parse calls ✅ - -- Replaced bare `JSON.parse` with `safeJSONParse` from `lib/fileUtils.js` in 7 files (8 call sites): `agentContentGenerator.js`, `pm2Standardizer.js`, `automationScheduler.js`, `git.js` (2), `aiDetect.js`, `memoryClassifier.js`, `clinvar.js` -- `digital-twin.js` and `cos.js` were already using `safeJSONParse` - -## S8: Add iteration limit to cron parser ✅ - -- `MAX_CRON_ITERATIONS = 525960` iteration counter in `server/services/eventScheduler.js` -- `validateCronFieldRange()` upfront validation, early `null` return on invalid expressions - -## S9: Extract validation boilerplate to helper ✅ - -- `validateRequest(schema, data)` helper in `lib/validation.js` now used across 80 call sites in 12 route files - -## S10: Fix parseInt missing radix ✅ - -- Fixed 45+ call sites across 18 files (routes, services, client, tests) diff --git a/docs/features/product-surfaces.md b/docs/features/product-surfaces.md index a11540ff60..1eddc70bd5 100644 --- a/docs/features/product-surfaces.md +++ b/docs/features/product-surfaces.md @@ -35,7 +35,7 @@ Manage local applications, terminal environments, system resources, and develope | **Storage Report & Disk Cleanup** | `/system-resources/storage` | Comprehensive disk usage breakdown, cache directory inspection, AI-assisted cleanup triage, and temporary artifact removal. | [STORAGE.md](../STORAGE.md) | | **Active Queues** | `/system-resources/queues` | Live inspection of background job queues (media renders, agent tasks, batch jobs), queue prioritization, and cancellation. | — | | **Uploads Staging** | `/uploads` | File upload manager and staging directory for media, documents, and datasets. | — | -| **Activity & Action History** | `/devtools/history` | Historical audit log of user actions, system mutations, and automated tasks. | [SECURITY_AUDIT.md](../SECURITY_AUDIT.md) | +| **Activity & Action History** | `/devtools/history` | Historical audit log of user actions, system mutations, and automated tasks. | — | | **Code & Script Runner** | `/devtools/runner` | Ad-hoc code execution environment and script runner for quick operational utilities. | — | | **GitHub Integration** | `/devtools/github` | Pull request tracking, open issue triage, commit log browsing, branch switching, and upstream synchronization. | [GITHUB_ACTIONS.md](../GITHUB_ACTIONS.md) | | **JIRA Sprint Manager & Reports** | `/devtools/jira`, `/devtools/jira/reports` | JIRA sprint planning, active board triage, backlog management, velocity metrics, and sprint burndown reports. | [JIRA Sprint Manager](./jira-sprint-manager.md) | @@ -206,7 +206,7 @@ Local AI model acceleration, multi-machine peer federation, storage classificati | **Instances & Peer Federation** | `/instances`, `/settings/sharing` | Multi-install peer federation across Tailscale VPN, capability discovery, and federated media generation offloading. | [FEDERATED_MEDIA_PROVIDERS.md](../FEDERATED_MEDIA_PROVIDERS.md) | | **PostgreSQL Datastore** | `/settings/database` | Mandatory local PostgreSQL datastore with pgvector extension, migrations, and storage classification contract. | [STORAGE.md](../STORAGE.md), [Postgres ADR](../decisions/2026-06-07-postgres-as-primary-datastore.md) | | **Backup & Restore** | `/settings/backup` | Automated filesystem rsync snapshots and database dumps with point-in-time restore. | [BACKUP.md](../BACKUP.md) | -| **Security & Trust Model** | `/settings/security`, `/security` | Opt-in instance password authentication, TLS certificates (`setup:cert`), Tailscale trust boundary, port allocation, and audit logs. | [PORTS.md](../PORTS.md), [SECURITY_AUDIT.md](../SECURITY_AUDIT.md), [REMOTE_DESKTOP.md](../REMOTE_DESKTOP.md) | +| **Security & Trust Model** | `/settings/security`, `/security` | Opt-in instance password authentication, TLS certificates (`setup:cert`), Tailscale trust boundary, port allocation, and audit logs. | [SETUP.md](../SETUP.md), [PORTS.md](../PORTS.md), [REMOTE_DESKTOP.md](../REMOTE_DESKTOP.md) | ---