[batteryshark]

Security hardening for the Toolstack broker, admin, runner and REST forwarder.

What changes

• REST forwarder: operator-owned secret placement. Secrets can only be placed through operator-authored per-operation headers / body_template with an explicit allowed_secrets list. Callers can no longer put {{secret:NAME}} in headers or bodies; such requests are refused. body_substitution is no longer supported. Refresh responses no longer expose secret names or lengths.
• Tool secret declarations are operator-approved. Start/Edit records the declarations and a manifest digest; recovery and SPS re-registration use that record, not whatever is on disk. "Update from source" keeps local declarations and reports upstream differences. Binding a secret item other than the tool's own id needs explicit confirmation. Declarations are shown on the tools page beside Start, and Start (web and Mac) says a started tool runs with this host's credentials.
• SPS link reads only what it needs (host, port, CA, secret); unverified TLS to SPS requires an explicit development flag.
• Broker: bearer checked before reading large bodies; tool/op names validated before audit or reservation; request-status polls rate-limited; approver notes bounded and masked.
• Admin: trusted-host check; sessions carry an id and sign-out revokes it on the server (web and Mac, new API logout); /api/audit returns metadata only; private files and state folders created owner-only.
• Runner/egress: fake-SPS flag no longer passed to tools; symlinked tool log folders refused; egress CONNECT limited to allowed host:port.
• Client and forwarder ignore ambient proxy settings.
• Installer: log and admin state folders created 0700 (SPS refused to start with the previous modes).

Upgrade notes

• REST tools that used caller placeholders must move secrets into operator headers/body_template with allowed_secrets.
• Tools that were running before the upgrade need one operator Start before automatic recovery resumes.
• Everyone signs in again (new session format).

Known limits

• All Toolstack processes still share one OS account; the dedicated Toolstack VM is the isolation boundary.
• A dead tool's loopback port could be taken by another local account; out of scope for the single-purpose VM.