fix(security): consolidate host environment leak guard

pmoves/bootstrap/registry.json

@@ -169,6 +169,60 @@
           "required": false,
           "sensitive": false
         },
+        {
+          "key": "HTTP_PROXY",
+          "file": "pmoves/env.shared",
+          "prompt": null,
+          "default": "",
+          "help": "HTTP proxy — cleared to prevent Windows host leak into containers.",
+          "required": false,
+          "sensitive": false
+        },
+        {
+          "key": "HTTPS_PROXY",
+          "file": "pmoves/env.shared",
+          "prompt": null,
+          "default": "",
+          "help": "HTTPS proxy — cleared to prevent Windows host leak into containers.",
+          "required": false,
+          "sensitive": false
+        },
+        {
+          "key": "NO_PROXY",
+          "file": "pmoves/env.shared",
+          "prompt": null,
+          "default": "",
+          "help": "Proxy bypass list — cleared to prevent Windows host leak into containers.",
+          "required": false,
+          "sensitive": false
+        },
+        {
+          "key": "REQUESTS_CA_BUNDLE",
+          "file": "pmoves/env.shared",
+          "prompt": null,
+          "default": "",
+          "help": "Python requests CA bundle — cleared to prevent Windows host leak.",
+          "required": false,
+          "sensitive": false
+        },
+        {
+          "key": "CURL_CA_BUNDLE",
+          "file": "pmoves/env.shared",
+          "prompt": null,
+          "default": "",
+          "help": "curl CA bundle — cleared to prevent Windows host leak into containers.",
+          "required": false,
+          "sensitive": false
+        },
+        {
+          "key": "NODE_EXTRA_CA_CERTS",
+          "file": "pmoves/env.shared",
+          "prompt": null,
+          "default": "",
+          "help": "Node.js extra CA certs — cleared to prevent Windows host leak.",
+          "required": false,
+          "sensitive": false
+        },
         {
           "key": "SUPABASE_URL",
           "file": "pmoves/env.shared",

pmoves/docker-compose.yml

@@ -193,6 +193,28 @@ x-env-tier-supabase-ro: &id008ro
     - /tmp:noexec,nosuid,size=64m
     - /var/tmp:noexec,nosuid,size=64m
 
+# =============================================================================
+# HOST ENVIRONMENT LEAK GUARD
+# =============================================================================
+# Windows Docker Desktop inherits host env vars into containers. Linux
+# containers cannot use Windows paths (SSL_CERT_FILE, REQUESTS_CA_BUNDLE) or
+# corporate proxy settings (HTTP_PROXY). This anchor list nullifies all known
+# leak vectors. Apply to every service environment block.
+#
+# Precedence: environment block > env_file > host inheritance.
+# Empty assignment effectively unsets the variable in the container.
+#
+# Canonical guard list (copy into each service environment block):
+#   - SSL_CERT_FILE=
+#   - SSL_CERT_DIR=
+#   - REQUESTS_CA_BUNDLE=
+#   - CURL_CA_BUNDLE=
+#   - NODE_EXTRA_CA_CERTS=
+#   - HTTP_PROXY=
+#   - HTTPS_PROXY=
+#   - NO_PROXY=
+# =============================================================================
+
 # =============================================================================
 # CONTAINER HARDENING TEMPLATES (Security Baseline)
 # =============================================================================
@@ -1138,9 +1160,15 @@ services:
       dockerfile: services/hi-rag-gateway/Dockerfile
     restart: unless-stopped
     environment:
-    # Neutralise Windows SSL_CERT_FILE leak (host env > env_file precedence)
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
     - SSL_CERT_DIR=
+    - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     - QDRANT_URL=${QDRANT_URL:-http://qdrant:6333}
     - QDRANT_COLLECTION=${QDRANT_COLLECTION:-pmoves_chunks_qwen3}
     - SENTENCE_MODEL=${SENTENCE_MODEL:-all-MiniLM-L6-v2}
@@ -1320,10 +1348,15 @@ services:
     - TENSORZERO_EMBED_MODEL=${TENSORZERO_EMBED_MODEL:-qwen3_embedding_4b_local}
     - TENSORZERO_EMBED_TIMEOUT_SECS=${TENSORZERO_EMBED_TIMEOUT_SECS:-120}
     - TENSORZERO_EMBED_BATCH_SIZE=${TENSORZERO_EMBED_BATCH_SIZE:-16}
-    # Clear Windows SSL env leak (same pattern as flute-gateway)
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
     - SSL_CERT_DIR=
     - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     - MEILI_URL=${MEILI_URL:-http://meilisearch:7700}
     - SUPA_REST_URL=${SUPA_REST_URL:-http://supabase-kong:8000/rest/v1}
     - SUPA_REST_INTERNAL_URL=${SUPA_REST_INTERNAL_URL:-http://supabase-kong:8000/rest/v1}
@@ -1491,9 +1524,15 @@ services:
     - USE_CUDA=${USE_CUDA:-true}
     - NVIDIA_VISIBLE_DEVICES=${NVIDIA_VISIBLE_DEVICES:-all}
     - FFW_PROVIDER=${FFW_PROVIDER:-faster-whisper}
-    # Clear Windows host SSL paths that leak into containers via Docker env inheritance
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
     - SSL_CERT_DIR=
+    - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     - WHISPER_MODEL=${WHISPER_MODEL:-small}
     - WHISPER_LANGUAGE=${WHISPER_LANGUAGE:-en}
     deploy:
@@ -1629,9 +1668,15 @@ services:
     - TOPOLOGY_MODE=${TOPOLOGY_MODE:-docked}
     - PARENT_SYSTEM=${PARENT_SYSTEM:-PMOVES.AI}
     - PARENT_VERSION=${PARENT_VERSION:-1.0.0-hardened}
-    # Prevent Windows SSL_CERT_FILE env leak
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
     - SSL_CERT_DIR=
+    - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     volumes:
     - ./config:/app/config
     - pmoves-yt-data:/data
@@ -1679,9 +1724,15 @@ services:
     build: ./services/channel-monitor
     restart: unless-stopped
     environment:
-    # Neutralise Windows SSL_CERT_FILE leak (host env > env_file precedence)
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
     - SSL_CERT_DIR=
+    - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     - CHANNEL_MONITOR_CONFIG_PATH=${CHANNEL_MONITOR_CONFIG_PATH:-/app/config/channel_monitor.json}
     - CHANNEL_MONITOR_QUEUE_URL=${CHANNEL_MONITOR_QUEUE_URL:-http://pmoves-yt:8077/yt/ingest}
     - CHANNEL_MONITOR_NAMESPACE=${CHANNEL_MONITOR_NAMESPACE:-pmoves}
@@ -1722,9 +1773,15 @@ services:
       dockerfile: services/hi-rag-gateway-v2/Dockerfile
     restart: unless-stopped
     environment:
-    # Neutralise Windows SSL_CERT_FILE leak (host env > env_file precedence)
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
     - SSL_CERT_DIR=
+    - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     - QDRANT_URL=${QDRANT_URL:-http://qdrant:6333}
     - QDRANT_COLLECTION=${QDRANT_COLLECTION:-pmoves_chunks_qwen3}
     - QDRANT_RECREATE_ON_DIM_MISMATCH=${QDRANT_RECREATE_ON_DIM_MISMATCH:-false}
@@ -1763,8 +1820,15 @@ services:
     - TOPOLOGY_MODE=${TOPOLOGY_MODE:-docked}
     - PARENT_SYSTEM=${PARENT_SYSTEM:-PMOVES.AI}
     - PARENT_VERSION=${PARENT_VERSION:-1.0.0-hardened}
-    # Prevent Windows SSL_CERT_FILE env leak
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
+    - SSL_CERT_DIR=
+    - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     extra_hosts:
     - host.docker.internal:host-gateway
     ports:
@@ -1795,9 +1859,15 @@ services:
       - TORCH_SKIP_CUDA=0
     restart: unless-stopped
     environment:
-    # Neutralise Windows SSL_CERT_FILE leak (host env > env_file precedence)
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
     - SSL_CERT_DIR=
+    - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     - QDRANT_URL=${QDRANT_URL:-http://qdrant:6333}
     - QDRANT_COLLECTION=${QDRANT_COLLECTION:-pmoves_chunks_qwen3}
     - QDRANT_RECREATE_ON_DIM_MISMATCH=${QDRANT_RECREATE_ON_DIM_MISMATCH:-false}
@@ -1873,9 +1943,15 @@ services:
     - --port
     - '8086'
     environment:
-    # Neutralise Windows SSL_CERT_FILE leak (host env > env_file precedence)
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
     - SSL_CERT_DIR=
+    - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     - QDRANT_URL=${QDRANT_URL:-http://qdrant:6333}
     - QDRANT_COLLECTION=${QDRANT_COLLECTION:-pmoves_chunks_qwen3}
     - SENTENCE_MODEL=${SENTENCE_MODEL:-all-MiniLM-L6-v2}
@@ -1918,8 +1994,15 @@ services:
     - TOPOLOGY_MODE=${TOPOLOGY_MODE:-docked}
     - PARENT_SYSTEM=${PARENT_SYSTEM:-PMOVES.AI}
     - PARENT_VERSION=${PARENT_VERSION:-1.0.0-hardened}
-    # Prevent Windows SSL_CERT_FILE env leak
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
+    - SSL_CERT_DIR=
+    - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     gpus: all
     deploy:
       resources:
@@ -2046,8 +2129,15 @@ services:
     - A0_SET_browser_model_provider=openai
     - A0_SET_browser_model_name=tensorzero::function_name::agent_zero
     - A0_SET_browser_model_api_base=http://tensorzero-gateway:3000/openai/v1
-    # Prevent Windows SSL_CERT_FILE env leak (Windows path not valid in Linux container)
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
+    - SSL_CERT_DIR=
+    - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     depends_on:
       nats:
         condition: service_healthy
@@ -2117,8 +2207,15 @@ services:
       - GH_APP_ID=${GH_APP_ID:-}
       - GH_APP_SEC=${GH_APP_SEC:-}
       - GH_APP_INSTALLATION_ID=${GH_APP_INSTALLATION_ID:-}
-      # Prevent Windows SSL_CERT_FILE env leak
+      # Host environment leak guard (see x-host-leak-guard docs above)
       - SSL_CERT_FILE=
+      - SSL_CERT_DIR=
+      - REQUESTS_CA_BUNDLE=
+      - CURL_CA_BUNDLE=
+      - NODE_EXTRA_CA_CERTS=
+      - HTTP_PROXY=
+      - HTTPS_PROXY=
+      - NO_PROXY=
     depends_on:
       nats:
         condition: service_healthy
@@ -2521,9 +2618,15 @@ services:
     environment:
     - OLLAMA_HOST=0.0.0.0:11434
     - OLLAMA_MODELS=/root/.ollama/models
-    # Override Windows SSL cert paths leaked via env inheritance (x509 failures)
+    # Host environment leak guard (see x-host-leak-guard docs above)
     - SSL_CERT_FILE=
     - SSL_CERT_DIR=
+    - REQUESTS_CA_BUNDLE=
+    - CURL_CA_BUNDLE=
+    - NODE_EXTRA_CA_CERTS=
+    - HTTP_PROXY=
+    - HTTPS_PROXY=
+    - NO_PROXY=
     - DOCKED_MODE=${DOCKED_MODE:-true}
     - TOPOLOGY_MODE=${TOPOLOGY_MODE:-docked}
     - PARENT_SYSTEM=${PARENT_SYSTEM:-PMOVES.AI}
@@ -2807,10 +2910,15 @@ services:
       - CHIT_REQUIRE_SIGNATURE=${CHIT_PROD_REQUIRE_SIGNATURE:-true}
       - CHIT_DECRYPT_ANCHORS=${CHIT_PROD_DECRYPT_ANCHORS:-true}
       - CHIT_PASSPHRASE=${CHIT_PROD_PASSPHRASE:?set CHIT_PROD_PASSPHRASE in env.shared}
-      # Clear Windows SSL env leak — host miniconda paths don't exist in container
+      # Host environment leak guard (see x-host-leak-guard docs above)
       - SSL_CERT_FILE=
       - SSL_CERT_DIR=
       - REQUESTS_CA_BUNDLE=
+      - CURL_CA_BUNDLE=
+      - NODE_EXTRA_CA_CERTS=
+      - HTTP_PROXY=
+      - HTTPS_PROXY=
+      - NO_PROXY=
     ports: ["${FLUTE_BIND:-127.0.0.1}:8055:8055", "${FLUTE_BIND:-127.0.0.1}:8056:8056"]
     profiles: ["orchestration", "media"]
     # Attach a non-internal bridge so published host ports resolve on Docker Desktop.

pmoves/env.shared.example

@@ -17,6 +17,15 @@
 SSL_CERT_FILE=
 SSL_CERT_DIR=
 
+# Prevent Windows proxy/CA env leak into Linux containers.
+# Corporate proxy settings from host are invalid inside container network.
+HTTP_PROXY=
+HTTPS_PROXY=
+NO_PROXY=
+REQUESTS_CA_BUNDLE=
+CURL_CA_BUNDLE=
+NODE_EXTRA_CA_CERTS=
+
 # NATS Message Bus - Event-driven coordination backbone
 NATS_URL=nats://nats:pmoves@nats:4222
 NATS_USER=nats

pmoves/tools/sanitize_env_shared.py

@@ -49,9 +49,11 @@ def build_allowlist() -> set:
                 if key:
                     allowed.add(key)
 
-    # 4. Always allow these infrastructure vars
+    # 4. Always allow these infrastructure vars (empty = nullify host leaks)
     allowed.update({
         "SSL_CERT_FILE", "SSL_CERT_DIR",
+        "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
+        "REQUESTS_CA_BUNDLE", "CURL_CA_BUNDLE", "NODE_EXTRA_CA_CERTS",
         "DOCKED_MODE", "TOPOLOGY_MODE", "PARENT_SYSTEM", "PARENT_VERSION",
     })