Harden OmniWork for untrusted input; add tool-free completion mode

[inquerium]

Summary

Hardens OmniWork for untrusted input and adds a tool-free completion mode, from a read-only audit made while integrating OmniWork into a tool that scores untrusted documents. Every finding was checked against the code first. Each of the 18 commits fixes one finding and adds a regression test; 16 new suites join npm run test:regression (32 total, all passing).

Security fixes (P0)

• File tools are confined by real path (d19e1ba). A symlink committed in a repo (docs/x -> ~/.ssh) carried read_file/write_file/edit_file/list_dir outside the workspace. Approval previews and ACP diffs read through it too. Writes now refuse symlinks (O_NOFOLLOW).
• Approval modes fail closed (e5ee830). An unknown or misspelled mode meant full auto. web_fetch, open_url, save_memory, save_skill and spawn_subagents ran unasked even in ask/plan. Memory and skill writes, which persist into every future session, now ask even in auto.
• ACP session/load path traversal (47e4e51). The session id was joined straight into a file path. cwd is now validated.
• A slow boot no longer wipes provider connections (1911907). storage.sqlite was renamed to *.corrupt-*.bak after any failed first boot. It is now set aside only when SQLite's quick_check says it is corrupt; backups are 0600, newest two kept.
• Explicit environments for commands and the gateway (29007a7). run_command and the gateway inherited every secret in the user's shell (and the gateway inherited CORS_ALLOW_ALL). Commands now run in a non-login shell.
• The gateway requires a key, and a guard checks Host/Origin (3c7d3b8). OmniRoute ran keyless, an invalid bearer was served as anonymous, and there was no Host check, so other local accounts and DNS-rebinding pages could use every connected provider. It now starts with REQUIRE_API_KEY and a per-install key that every OmniWork client sends. A --required guard refuses foreign Host and cross-site Origin headers. Port and key are recorded in ~/.omniwork/gateway.json, so every entry point adopts the running gateway correctly.

Tool-free completion (the main addition) — af190db

One request in, one completion out, via the ACP completion mode, the MCP complete tool, and npm run complete:

• the request has no tools/tool_choice, and the system prompt is used verbatim;
• no workspace, memory or skills are read, and nothing is written to disk;
• with a JSON Schema, output is validated and retried once with the errors, never coerced to {};
• ollama/<model> uses Ollama's native API, with a context sized to the prompt and a truncated flag;
• ACP session/new reports _meta.omniwork.toolFree: true and tools: [], and the mode is one-way.

P1 / P2 fixes

• No prompt bodies on disk (170c071). OmniRoute wrote every prompt and reply to world-readable call_logs/ for a week. OmniWork's key is now no-log, the gateway runs with umask 077, and old files are tightened. SECURITY.md no longer claims provider keys are stored encrypted (they aren't; see below).
• Keyless OpenCode impersonation is off; pool failures explain themselves (b29b732). This fixes the 502 wall on auto/* with nothing connected.
• A pool's 502/504 now counts as "no model", so the engine fallback runs; failed pools are no longer walked twice (3075385).
• ACP (195655a):
  • "always allow" applies per tool (a command: that exact command) instead of switching the session to auto, and reject_always is added;
  • a subagent's tool call is announced before its permission request, and a cancelled answer stops the turn;
  • stdio mcpServers are accepted;
  • model failures return a stop reason;
  • opt-in strict client capabilities.
• MCP protocol version negotiation (6e9bb5c).
• Repository files are lower-trust context (d3e9f0f). AGENTS.md/CLAUDE.md/.cursorrules were injected with the user's authority, and read through symlinks: AGENTS.md -> ~/.ssh/id_rsa put the key in the prompt sent to the provider. A repo skill can no longer shadow a global one. OMNIWORK_PROJECT_FILES=off leaves repository files out entirely.
• Local models (880c9f1). OLLAMA_HOST (and the other local servers' env vars) are honoured. "Not running" is diagnosed: nothing listening vs. erroring, a models folder linked to a missing drive, server-log errors. OMNIWORK_PREFER_LOCAL.
• One gateway store for the app and headless servers (87504cd). A provider connected in the app now also reaches MCP, ACP and the CLI.
• Supply chain (eadc54d). omniroute is pinned exactly, and the Lite build's engine tarball is checked against a pinned sha512 before unpacking.
• Review fixes (3939db2) and a test-timing fix (3996512).

Behaviour changes and escape hatches (each kept for one release)

Change	Restore the old behaviour
The gateway requires the per-install key. Tools that call it directly must send Authorization: Bearer $(cat ~/.omniwork/gateway-key.txt)	OMNIWORK_GATEWAY_OPEN=1
Commands don't see shell tokens (GITHUB_TOKEN, SSH_AUTH_SOCK, …) or a login shell	OMNIWORK_COMMAND_ENV_PASSTHROUGH=NAME,… or OMNIWORK_COMMAND_ENV=inherit
The gateway gets an explicit environment	OMNIWORK_GATEWAY_ENV_PASSTHROUGH / OMNIWORK_GATEWAY_ENV=inherit (never CORS_*)
auto asks before global memory and skill writes	OMNIWORK_AUTO_PERSIST=1
ACP model failures end the turn instead of returning a JSON-RPC error	OMNIWORK_ACP_ERRORS=rpc
Prompt bodies are not logged	OMNIWORK_GATEWAY_LOGS=on (owner-only, one day)
Keyless OpenCode Free is blocked once per store	OMNIWORK_KEYLESS_OPENCODE=on

Also: ACP lists a fifth mode (completion) plus a mode config option; MCP lists 18 tools (adds complete).

Verification

• npm run test:regression: 32 suites pass. The key new tests were also run against the base commit and fail there (symlink escape, approval table, traversal, env leak, planted transcript, 502 classification, project-file key leak).
• Against the real OmniRoute in test/boot.js (also the CI boot job):
  • no key or a wrong key → 401 (models and chat);
  • foreign Host → 403 (including the management API), cross-site Origin → 403;
  • keyless OpenCode blocked;
  • a prompt routed upstream through a local stand-in leaves no body on disk, and every file the gateway writes is owner-only.
• End to end on a real local model (Ollama 0.34, qwen3:8b), through omniwork-acp in completion mode with a 29k-character adversarial deck:
  • toolFree: true;
  • num_ctx 16384, all 7,440 prompt tokens read, truncated: false;
  • schema-valid output, with the injection flagged and not obeyed;
  • zero tool_call updates, no files written, no transcript, and the gateway never started.

Not in this PR / follow-ups

• Provider keys are stored unencrypted. OmniRoute only encrypts with STORAGE_ENCRYPTION_KEY, which a direct server.js spawn never sets. Turning it on would break older OmniWork builds that share the store, so it needs a decision.
• OmniRoute's management API (/api/*) is still anonymous to other accounts on the same host while the dashboard has no password. Browsers and DNS rebinding are blocked by the guard.
• The OpenCode engine and MCP server processes still inherit the full environment.
• Persisted model health (A1.2), delegating fs/terminal to ACP clients, an OS sandbox for run_command, and a desktop trust prompt for new workspaces.
• Merge note: the in-progress desktop auto-engine-routing work rewrites the fallback block in electron/sessions.js (which still misses 502) and touches #requestModel in agent.js near the diagnostics added here. When it lands, it should use isNoModelFailure from agent.js.

🤖 Generated with Claude Code