fix(security): P2 triage sweep — query injection, CVE pins, CodeQL fixes

[POWERFULMOVES]

Summary

• Close all 4 production-blocking P2 security items
• Pin 4 CVE-patched dependency versions in archon + deepresearch Dockerfiles
• Fix 2 CodeQL alerts in chrome extension (XSS, unvalidated method)
• Refresh P2 tracker and production audit dashboard

Changes

• yt.py: Validate Hi-RAG-sourced video_id with _SAFE_VID_RE before Supabase query
• archon/Dockerfile: Pin crawl4ai>=0.8.0, langchain-core>=1.2.5
• deepresearch/Dockerfile: Pin ray>=2.52.0, vllm>=0.14.1
• options.js: Replace innerHTML with DOM API (textContent)
• mock-server.js: Guard dynamic property access with Object.hasOwn()
• Dashboard + P2 tracker: Close P2 Feat/hirag hybrid #1/feat: LangExtract core + Hi‑RAG v2 hybrid, data IO, Supabase full, realtime UI, avatars #4/Feat/langextract supabase realtime #7/Feat/langextract supabase realtime #8, update stale PR statuses

Test plan

• git diff each commit verifies single-concern changes
• CodeQL re-scan should drop from 2 → 0 open alerts
• Trivy re-scan on archon/deepresearch should show reduced CRITICAL count
• _SAFE_VID_RE rejects non-alphanumeric video IDs in yt search path

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Resolved critical authentication and configuration management issues across multiple services
  • Improved HTML rendering safety in extension options interface
  • Added video ID validation to prevent invalid inputs

• Security

  • Hardened container security by running images with reduced privileges
  • Strengthened input validation mechanisms across services to prevent injection attacks
  • Verified fixes for multiple production-blocking security vulnerabilities

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR encompasses multiple updates across documentation, Docker configurations, and application code. Key changes include: submodule commit updates, environment variable renaming from MCP_CREDENTIALS_PATH to MCP_CONFIG_PATH, DOM manipulation refactoring for safer HTML rendering in the Chrome extension, runtime improvements in three Dockerfiles with new dependencies and a non-root user directive, and a security validation guard for video ID extraction in PMOVES.YT.

Changes

Cohort / File(s)	Summary
Submodule Commits PMOVES-Archon, PMOVES-llama-throughput-lab	Updated subproject commit hashes to incorporate upstream changes without behavioral or structural modifications to code or configuration.
Documentation & Audit Updates docs/phase2-buildkit-secrets-migration-plan.md, pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md, pmoves/docs/security/P2_SUBMODULE_TRACKER.md	Renamed MCP_CREDENTIALS_PATH to MCP_CONFIG_PATH in migration plan; updated audit dashboard with P2 triage sweep results, CI health status degraded, and AB-9 regressed blocker; marked production-blocking P2 items (Open-Notebook, BoTZ, PMOVES.YT, DoX) as FIXED with verification notes and corrected file paths.
Chrome Extension Security Refactoring pmoves/chrome-extension/options/options.js, pmoves/chrome-extension/test/mock-server.js	Replaced unsafe innerHTML row building with explicit DOM createElement and textContent population for safer HTML handling; added Object.hasOwn guard to route handler lookups to prevent inherited property access.
Docker Configuration & Dependencies pmoves/services/archon/Dockerfile, pmoves/services/deepresearch/Dockerfile, pmoves/images/firefly-iii/Dockerfile	Renamed environment variable MCP_CREDENTIALS_PATH to MCP_CONFIG_PATH and added packages crawl4ai>=0.8.0 and langchain-core>=1.2.5 to Archon; added ray>=2.52.0 and vllm>=0.14.1 to DeepResearch; added non-root user directive (www-data) to Firefly-III with defense-in-depth rationale.
Application Security Guard pmoves/services/pmoves-yt/yt.py	Added video\_id validation using \_SAFE\_VID\_RE regex pattern to restrict processing to alphanumeric, underscore, and hyphen characters (1–64 chars), skipping non-conforming IDs upstream.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• docs(audit): resolve AB-9, refresh P2 tracker, triage Trivy failures #836: Both PRs modify PRODUCTION_AUDIT_DASHBOARD.md and P2_SUBMODULE_TRACKER.md with overlapping P2 tracker refreshes and production-blocking item status updates.
• fix(ci): unblock integrations GHCR + lockfile builds #312: Both PRs modify pmoves/services/deepresearch/Dockerfile with changes to Python dependency installation and package additions.
• fix(ghcr): close 4 missing image gaps + targeted local build targets #822: Both PRs touch the PMOVES-llama-throughput-lab submodule commit hashes and GHCR/images matrix integration.

Suggested labels

codex

Poem

🐰 With configs renamed and guards standing tall,
Chrome DOM rendered so safe, oh so thrall!
P2 trackers refreshed, blockers now mend,
Dockerfiles hardened—a security trend! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix(security): P2 triage sweep — query injection, CVE pins, CodeQL fixes' directly and specifically summarizes the three main security fixes in the changeset: query injection prevention, CVE dependency pinning, and CodeQL alert fixes.
Description check	✅ Passed	The PR description includes a clear summary, detailed changes list, and test plan covering all key modifications. However, the template's required 'Testing' section (with command output) is not fully completed, and 'Required Checks' checklist items are not marked.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/dockerfile-audit-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

pmoves/services/archon/Dockerfile (1)

155-157: Use exact override versions here, not floating minimums.

>= turns these security overrides into moving targets, so a rebuild can pull a newer crawl4ai or langchain-core release without any Dockerfile diff. If 0.8.0 and 1.2.5 are the vetted fixes, pin them exactly and bump intentionally.

Suggested change

-    && pip install --no-cache-dir \
-       "crawl4ai>=0.8.0" \
-       "langchain-core>=1.2.5" \
+    && pip install --no-cache-dir \
+       "crawl4ai==0.8.0" \
+       "langchain-core==1.2.5" \

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pmoves/services/archon/Dockerfile` around lines 155 - 157, The Dockerfile
currently uses floating-minimum pins "crawl4ai>=0.8.0" and
"langchain-core>=1.2.5" which makes rebuilds pull newer, unvetted releases;
change these to exact pins (e.g. "crawl4ai==0.8.0" and "langchain-core==1.2.5")
in the pip install line so the image reproducibly uses the vetted fixes, and
update any accompanying comment or release notes to document intentional bumps
in future.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md`:
- Line 30: Normalize all AB-9 status mentions to a single authoritative
snapshot: pick the correct current state for AB-9 (e.g., "All 4 self-hosted
runners offline" or "1/4 online"), then update every occurrence—the
"latest-changes" paragraph, the "executive summary", and the "AB-9 blocker
row"—so they all state the same status and supporting evidence (mention affected
runners `ai-lab-runner`, `ai-lab-win`, `hotfix-runner`, `vps-runner` and the
required restart commands `svc.sh install`/`run.cmd`); ensure GHCR build impact
(`[self-hosted, Linux, X64, vps]`) is consistently described and align the
runbook/smoke evidence text with that chosen snapshot.
- Around line 16-21: The summary line "P2 Tier 1 triage sweep — 3 of 4" is
inconsistent with the four bullets marked FIXED (P2 `#4` Open-Notebook, P2 `#1`
BoTZ, P2 `#8` DoX, P2 `#7` PMOVES.YT) and the later "4 production-blocking items
closed" statement; update the header to match the evidence (change "3 of 4" to
"4 of 4") or, alternatively, if one of the bullets is incorrect, remove or
unmark that specific bullet so the count and the list align; ensure the phrase
"P2 Tier 1 triage sweep" and the later "P2 tracker updated — 4
production-blocking items closed" are consistent.

---

Nitpick comments:
In `@pmoves/services/archon/Dockerfile`:
- Around line 155-157: The Dockerfile currently uses floating-minimum pins
"crawl4ai>=0.8.0" and "langchain-core>=1.2.5" which makes rebuilds pull newer,
unvetted releases; change these to exact pins (e.g. "crawl4ai==0.8.0" and
"langchain-core==1.2.5") in the pip install line so the image reproducibly uses
the vetted fixes, and update any accompanying comment or release notes to
document intentional bumps in future.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 19d23de6-2b51-4e24-bffe-6b2a1567c113

📥 Commits

Reviewing files that changed from the base of the PR and between e81f37d and b9317e3.

📒 Files selected for processing (11)

• PMOVES-Archon
• PMOVES-llama-throughput-lab
• docs/phase2-buildkit-secrets-migration-plan.md
• pmoves/chrome-extension/options/options.js
• pmoves/chrome-extension/test/mock-server.js
• pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md
• pmoves/docs/security/P2_SUBMODULE_TRACKER.md
• pmoves/images/firefly-iii/Dockerfile
• pmoves/services/archon/Dockerfile
• pmoves/services/deepresearch/Dockerfile
• pmoves/services/pmoves-yt/yt.py

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

The blocker closeout count contradicts itself.

Line 16 says 3 of 4 production-blocking P2 items were fixed, but the bullets below mark four items fixed and Line 21 says four blockers were closed. Please collapse this to one number before publishing the dashboard.

As per coding guidelines, "Keep status claims aligned with evidence in runbooks and smokes."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md` around lines 16 - 21, The summary
line "P2 Tier 1 triage sweep — 3 of 4" is inconsistent with the four bullets
marked FIXED (P2 `#4` Open-Notebook, P2 `#1` BoTZ, P2 `#8` DoX, P2 `#7` PMOVES.YT) and
the later "4 production-blocking items closed" statement; update the header to
match the evidence (change "3 of 4" to "4 of 4") or, alternatively, if one of
the bullets is incorrect, remove or unmark that specific bullet so the count and
the list align; ensure the phrase "P2 Tier 1 triage sweep" and the later "P2
tracker updated — 4 production-blocking items closed" are consistent.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

AB-9 is reported with multiple conflicting runner states.

The latest-changes section says all four self-hosted runners are offline, the executive summary says 1/4 is online, and the AB-9 blocker row is now regressed/offline again. Please normalize every AB-9 reference to the same snapshot; right now the dashboard is self-contradictory.

As per coding guidelines, "Keep status claims aligned with evidence in runbooks and smokes."

Also applies to: 374-375, 499-499

🧰 Tools

🪛 LanguageTool

[style] ~30-~30: Consider using “inaccessible” to avoid wordiness.
Context: ...unner+vps-runner` (remote machines, not accessible from dev workstation). WSL2 systemd now...

(NOT_ABLE_PREMIUM)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md` at line 30, Normalize all AB-9
status mentions to a single authoritative snapshot: pick the correct current
state for AB-9 (e.g., "All 4 self-hosted runners offline" or "1/4 online"), then
update every occurrence—the "latest-changes" paragraph, the "executive summary",
and the "AB-9 blocker row"—so they all state the same status and supporting
evidence (mention affected runners `ai-lab-runner`, `ai-lab-win`,
`hotfix-runner`, `vps-runner` and the required restart commands `svc.sh
install`/`run.cmd`); ensure GHCR build impact (`[self-hosted, Linux, X64, vps]`)
is consistently described and align the runbook/smoke evidence text with that
chosen snapshot.

[POWERFULMOVES]

Superseded by #841 (all commits included as superset). CodeRabbit findings fixed in #841's fix(review) commit.