daemon (remote): install_from_source kind:"path" is an unconfined daemon-host file read on the HTTP surface #2097

Severity: security (arbitrary daemon-host file read). Surface: shared remote/proxy daemon HTTP, not the local loopback CLI.

Problem

install_from_source with source.kind: "path" accepts an unconfined filesystem path over the HTTP surface. A remote authenticated caller can name any path the daemon user can read; the daemon materializes it as the install source, so its bytes flow back through the install pipeline. This is an arbitrary host-file read for anyone who can reach /rpc with a valid token.

Evidence (at 848c6ea733)

• The HTTP boundary accepts the path with only a non-empty check: parseInstallSource for kind === 'path' — return { kind: 'path', path: artifactPath }, no confinement.
• Materialization is unconfined: materializeLocalSource for kind: 'path' returns expandUserHomePath(source.path) directly (~ expansion, then used as-is).
• Contrast with the url kind, which has real hygiene: credentials rejected, blocked hostnames, DNS-resolved non-public-address rejection, plus redirect caps and HTTPS-downgrade blocks. The path kind has none of the equivalent host-side confinement.

Design: kind:"path" is a local affordance; the remote surface must not accept it by default

kind: "path" is legitimate for local/in-process flows and should stay:

• admin.ts and its source parse build path sources for local admin.
• diff-screenshot.ts builds one locally.

These do not cross the HTTP parseInstallSource boundary, so gating the HTTP surface leaves them untouched.

Fix:

1. Reject kind: "path" at the HTTP boundary by default. Return INVALID_ARGS unless a daemon config explicitly enables host-path installs (e.g. allowHostPathInstall: true), off by default.
2. When enabled, confine it. Require the resolved, symlink-realpathed absolute path to sit under an operator-configured allowlist root (an install-staging directory), the same "declare the trust boundary" shape the url kind already uses for network destinations.

Refactor required

• Gate + optional confinement helper in the HTTP parseInstallSource path branch (src/daemon/server/http-server.ts around L320). Small and self-contained.
• Add the daemon config surface for the opt-in + allowlist root; document it as a deliberate expansion of the daemon's trust boundary.
• Local callers (admin.ts, diff-screenshot.ts) are unaffected and need no change.

Acceptance criteria

• Over /rpc, install_from_source with kind: "path" is rejected with INVALID_ARGS when the opt-in is off (default). Handler-level test.
• With the opt-in on and an allowlist root, a path inside the root succeeds and a path outside it (including via ../symlink escape) is rejected. Realpath-based confinement test.
• Local flows that build path sources continue to work.

Related

Same "apply the public-URL / trust-boundary rule on the remote surface, leave trusted local flows alone" theme as the Maestro runScript http.post allowlist gap (filed separately).

Effort / risk

M (the gate is small; choosing and wiring the confinement root is the M part), MED risk.