security: harden local execution and package trust

.env.example

@@ -19,6 +19,11 @@ AUTO_OPEN_BROWSER=true
 AUTO_UPDATE_ENABLED=true
 # Legacy compatibility flag for the old bundled starter connection. Current builds do not bundle an OpenRouter API key or auto-create a usable OpenRouter Free connection; add your own connection in Settings.
 AUTO_CREATE_DEFAULT_CONNECTION=true
+# APK-managed Android installs set these internally. The Termux launcher reads
+# the private per-install secret file and exports the secret to the server; do
+# not copy or invent these values for an ordinary desktop/manual installation.
+# MARINARA_ANDROID_SECRET=
+# MARINARA_ANDROID_SECRET_FILE=$HOME/.marinara-engine/android-secret
 # Optional IANA timezone for server-side schedules (for example Europe/Warsaw).
 # Leave this commented to use the host system timezone; do not set an empty TZ=.
 # TZ=Europe/Warsaw
@@ -114,41 +119,39 @@ ALLOW_UNAUTHENTICATED_REMOTE=false
 #             100.64.0.0/10, fc00::/7, fe80::/10
 TRUSTED_PRIVATE_NETWORKS=
 
-# Trusted-interface bypass — when true, traffic from these ranges skips
-# BOTH the IP allowlist AND Basic Auth, the same way loopback does. Both
-# default to TRUE so a fresh install works out of the box for the two most
-# common "secure remote access" setups (Tailscale, Docker).
+# Trusted-interface bypass — traffic from these ranges can skip BOTH the IP
+# allowlist AND Basic Auth, the same way loopback does. Leave each value empty
+# for automatic detection, set true to force the bypass on, or false to turn it
+# off. Automatic mode trusts Tailscale only when both ends of the direct socket
+# use Tailscale addresses, and Docker only for this container's actual network
+# CIDRs and exact default gateway.
 #
 #   BYPASS_AUTH_TAILSCALE — trusts 100.64.0.0/10 (Tailscale CGNAT range).
 #                           Joining your tailnet already requires your
 #                           Tailscale account, so this is safe by default.
-#   BYPASS_AUTH_DOCKER    — trusts 172.16.0.0/12 (Docker bridge networks)
-#                           plus the exact default gateway detected inside a
-#                           Docker runtime. Gateway detection keeps localhost
-#                           working with Docker Desktop and custom address pools.
+#   BYPASS_AUTH_DOCKER    — in auto mode, trusts only the networks and exact
+#                           gateway detected inside this Docker runtime.
 #
-# Set either flag to false if your situation matches one of these caveats:
-#   • You run a CGNAT'd public uplink (your ISP uses 100.64.0.0/10 itself)
-#     AND you can't bind HOST to your tailscale0 IP. In that case an
-#     internet client could appear with a Tailscale-shaped source IP. Set
-#     BYPASS_AUTH_TAILSCALE=false (or fix the binding) to stay safe.
-#   • Your non-Docker LAN uses 172.16.x.x / 172.20.x.x addresses. The
-#     bypass would also trust those hosts. Set BYPASS_AUTH_DOCKER=false.
+# Set either flag explicitly if your situation matches one of these cases:
+#   • Set BYPASS_AUTH_TAILSCALE=true only when automatic socket detection is
+#     unavailable and you intentionally trust every 100.64.0.0/10 peer.
+#   • Set BYPASS_AUTH_DOCKER=true only when automatic container-network
+#     detection is unavailable and you intentionally trust 172.16.0.0/12.
 #   • You want a password from your Tailnet / containers too.
-BYPASS_AUTH_TAILSCALE=true
-BYPASS_AUTH_DOCKER=true
+BYPASS_AUTH_TAILSCALE=
+BYPASS_AUTH_DOCKER=
 # Docker reverse-proxy or tunnel traffic requires Marinara's normal Basic
 # Auth/IP allowlist checks by default. Direct Docker container/gateway traffic
 # without forwarding headers still follows BYPASS_AUTH_DOCKER.
 #
 # Set this to false only for legacy compatibility when every client behind the
 # proxy is trusted. That opt-out lets forwarded clients inherit Docker bypass.
 #
-# Scope note: this flag affects requests whose source IP is in 172.16.0.0/12
-# or matches the detected Docker default gateway. Proxies on Docker Swarm
-# overlays (10.0.0.0/8), Kubernetes pod networks, or other custom IPAM ranges
-# may present a different source IP and won't match. In those setups, gate
-# proxy traffic with
+# Scope note: this flag affects requests whose source IP matches a detected
+# container-interface CIDR or the exact Docker default gateway. Setting
+# BYPASS_AUTH_DOCKER=true also enables the legacy 172.16.0.0/12 match. Proxies
+# outside those networks still need explicit authentication. In those setups,
+# gate proxy traffic with
 # BASIC_AUTH_USER/BASIC_AUTH_PASS plus ALLOW_UNAUTHENTICATED_PRIVATE_NETWORK=false,
 # or add the specific proxy IP to IP_ALLOWLIST.
 REQUIRE_AUTH_FOR_DOCKER_PROXY=true
@@ -184,9 +187,14 @@ UPDATES_APPLY_ENABLED=false
 # Requires ADMIN_SECRET and UPDATES_APPLY_ENABLED=true.
 UPDATES_ALLOW_REMOTE_APPLY=false
 SIDECAR_RUNTIME_INSTALL_ENABLED=false
-# Trusted custom script tools only. Scripts run in an in-process VM realm with
-# no process/require/Buffer globals, not an OS-level sandbox.
+# Trusted custom script tools only. Each call runs in an isolated JavaScript
+# runtime inside a memory-capped worker Marinara can terminate.
 CUSTOM_TOOL_SCRIPT_ENABLED=false
+# `mari db transform` uses Seatbelt/bubblewrap automatically. On systems with
+# no supported OS sandbox, keep this false unless you personally reviewed the
+# local transform script and accept that Node permission mode is not a
+# malicious-code security boundary.
+MARI_DB_ALLOW_UNSAFE_TRANSFORMS=false
 # Unvetted GitHub agent repositories. Requires explicit trust confirmation in Agents Manager.
 ENABLE_CUSTOM_AGENT_REPOS=false
 # Third-party Personal Extension imports. This is only the first gate; users

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    target-branch: staging
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: staging
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: gradle
+    directory: /android
+    target-branch: staging
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/bunny-review.yml

@@ -57,16 +57,18 @@ jobs:
       BUNNY_LAST_REVIEWED_SHA: ${{ inputs.last_reviewed_sha || '' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Resolve PR refs
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           BASE=$(gh pr view "$PR_NUM" --json baseRefName -q .baseRefName)
           echo "PR_BASE_REF=$BASE" >> "$GITHUB_ENV"
+          gh auth setup-git
           git fetch --force origin "$BASE:refs/remotes/origin/$BASE"
 
       - name: Preserve review tooling from base branch
@@ -107,6 +109,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git status
+          gh auth setup-git
           git fetch origin "pull/$PR_NUM/head:pr-$PR_NUM"
           git checkout "pr-$PR_NUM"
           HEAD_SHA=$(gh pr view "$PR_NUM" --json headRefOid -q .headRefOid)
@@ -124,7 +127,7 @@ jobs:
             -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
             -f description="The trusted Bunny reviewer is inspecting this pull request." >/dev/null
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
 
@@ -144,6 +147,7 @@ jobs:
         run: |
           HEAD_SHA=$(gh pr view "$PR_NUM" --json headRefOid -q .headRefOid)
           if [ "$HEAD_SHA" != "$(git rev-parse HEAD)" ]; then
+            gh auth setup-git
             git fetch --force origin "pull/$PR_NUM/head:refs/remotes/bunny-review/pr-$PR_NUM"
             git checkout --detach "$HEAD_SHA"
           fi

.github/workflows/codeql.yml

@@ -0,0 +1,40 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  schedule:
+    - cron: "41 4 * * 2"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, javascript-typescript]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          category: /language:${{ matrix.language }}

.github/workflows/prealpha-platform-builds.yml

@@ -45,7 +45,9 @@ jobs:
       tag_name: ${{ steps.version.outputs.tag_name }}
       release_url: ${{ steps.create.outputs.release_url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
       - name: Compute pre-alpha version and tag
         id: version
@@ -65,7 +67,7 @@ jobs:
 
       - name: Create draft GitHub pre-release with warning notes
         id: create
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:
           TAG_NAME: ${{ steps.version.outputs.tag_name }}
           RELEASE_NAME: ${{ steps.version.outputs.release_name }}
@@ -161,24 +163,26 @@ jobs:
             platform: macos-latest
             rust_target: x86_64-apple-darwin
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: ${{ env.PNPM_VERSION }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
 
       - name: Install Rust stable
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           targets: ${{ matrix.rust_target }}
 
       - name: Rust cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           workspaces: src-tauri
 
@@ -204,19 +208,43 @@ jobs:
       - name: Install frontend dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Build and upload unsigned pre-alpha desktop bundle
-        uses: tauri-apps/tauri-action@v0
+      - name: Build unsigned pre-alpha desktop bundle
+        run: pnpm tauri build --ci --no-sign --config "${{ env.PREALPHA_CONFIG }}" --target "${{ matrix.rust_target }}"
+
+      - name: Collect desktop release assets
+        shell: bash
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          releaseId: ${{ needs.create-prealpha-release.outputs.release_id }}
-          releaseDraft: true
-          prerelease: true
-          includeUpdaterJson: false
-          updaterJsonPreferNsis: true
-          tauriScript: pnpm tauri
-          assetNamePattern: "Marinara-Engine-PreAlpha-${{ matrix.asset_slug }}_[version]_[arch][setup][ext]"
-          args: "--ci --no-sign --config ${{ env.PREALPHA_CONFIG }} --target ${{ matrix.rust_target }}"
+          ASSET_SLUG: ${{ matrix.asset_slug }}
+          RUST_TARGET: ${{ matrix.rust_target }}
+        run: |
+          set -euo pipefail
+          mkdir -p release-assets
+          bundle_root="src-tauri/target/${RUST_TARGET}/release/bundle"
+          while IFS= read -r -d '' file; do
+            base="$(basename "${file}" | tr ' ' '-' | tr -cd '[:alnum:]._+-')"
+            cp "${file}" "release-assets/Marinara-Engine-PreAlpha-${ASSET_SLUG}-${base}"
+          done < <(find "${bundle_root}" -type f \( \
+            -name '*.exe' -o \
+            -name '*.msi' -o \
+            -name '*.dmg' -o \
+            -name '*.AppImage' -o \
+            -name '*.deb' -o \
+            -name '*.rpm' -o \
+            -name '*.tar.gz' \
+          \) -print0)
+
+          asset_count="$(find release-assets -maxdepth 1 -type f | wc -l | tr -d ' ')"
+          if [ "${asset_count}" -eq 0 ]; then
+            echo "::error::No desktop release assets were produced."
+            exit 1
+          fi
+
+      - name: Upload desktop assets to draft pre-release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG_NAME: ${{ needs.create-prealpha-release.outputs.tag_name }}
+        run: gh release upload "${TAG_NAME}" release-assets/* --repo "${GITHUB_REPOSITORY}" --clobber
 
   build-android:
     name: Android universal debug APK
@@ -225,40 +253,42 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: ${{ env.PNPM_VERSION }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
 
       - name: Setup Java for Android Gradle
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
         with:
           distribution: temurin
           java-version: "17"
           cache: gradle
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
 
       - name: Setup Android NDK
         id: setup-ndk
-        uses: nttld/setup-ndk@v1
+        uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1
         with:
           ndk-version: r27
 
       - name: Install Rust stable with Android targets
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android
 
       - name: Rust cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           workspaces: src-tauri
 
@@ -292,7 +322,7 @@ jobs:
           fi
 
       - name: Upload Android workflow artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: prealpha-android-universal-debug-release-assets
           path: release-assets/
@@ -317,7 +347,7 @@ jobs:
       contents: write
     steps:
       - name: Publish draft pre-release without marking it latest
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:
           RELEASE_ID: ${{ needs.create-prealpha-release.outputs.release_id }}
         with: