fix: security fixes for 1.1.4

[freema]

Security fixes for 1.1.4. Each commit is self-contained and comes with a regression test that fails without it.

Changes

Tenant ownership on session routes (fix(server))
The ownership middleware was mounted where chi had not resolved {sessionID} yet, so the check never ran. The {sessionID} routes now live in their own subrouter with the middleware attached there. Test: TestSessionRoutes_TenantCannotReachForeignSession (router-level, all nine routes).

GitLab MR note commands need Developer access (fix(webhooks))
Note hooks don't carry the author's role, so /review, /fix and /fix-cr were dispatched for anyone who could comment on a same-project MR. The author's effective access level is now looked up through the members API (members/all) and must be ≥ 30, mirroring the GitHub author_association check. Any lookup failure refuses the command. Tests: TestGitLabNoteCommandRequiresDeveloperAccess, TestGitLabAccessLevel (local fake API).

Server-side git treats the workspace as untrusted (fix(git))
Git run by the server in a session workspace could be steered by configuration the AI CLI wrote there, and it inherited the server environment. All server-side git now goes through git.Command, which:

• pins program-running and submodule settings with -c;
• ignores the global config;
• allowlists the environment.

SanitizeRepoConfig rebuilds .git/config from an allowlist before use and refuses redirected .git directories. Fetch and push use the URL the session was cloned from, and the askpass helper answers only for that host. Tests:

• TestServerGitIgnoresWorkspaceExecutors
• TestPushIgnoresWorkspaceOrigin
• TestCommandEnvironmentExcludesServerSecrets
• TestSanitizeRepoConfig
• TestAskPassScriptOnlyAnswersRepoHost

Tenant sessions don't use operator credentials (fix(subscription))
In subscription mode, a tenant session could end up with operator-owned access through:

• registered keys;
• the env token fallback;
• tool auto-fill;
• operator MCP servers;
• local repository paths;
• another tenant's workspace.

All of these are now closed for sessions with a tenant. Operator sessions are unchanged. Tests:

• TestApplyTenant_RejectsForeignCredentials
• TestResolveToken_TenantSessionGetsNoOperatorToken
• TestSetupMCP_TenantSessionGetsNoOperatorCredentials
• TestResolveAccessToken
• TestResolver_ResolveOwnConfigSkipsAutoFill

Codex prompt can't inject options (fix(runner))
-- is now passed before the prompt. Test: TestCodexArgs_PromptCannotInjectOptions.

Behaviour changes for operators

• GitLab: the code_review.default_key_name token must be able to read project members (read_api/api). If it can't, note commands are refused.
• Git config: server-side git no longer reads ~/.gitconfig. Set TLS trust for self-hosted instances with GIT_SSL_CAINFO / SSL_CERT_FILE or /etc/gitconfig. Dev and action images set safe.directory there; it is now passed on the command line instead.
• Subscription tenants:
  • provider_key → 403; repo_url must be http(s).
  • Private repositories, PR creation and comment posting need the tenant's own access_token.
  • The operator's registered MCP servers are not added to tenant sessions.

Release notes draft (v1.1.4)

Security release. Upgrade from v1.1.3 or earlier is recommended for every deployment; subscription mode and GitLab webhook setups are the most affected.

Session isolation:

- Subscription tenants can reach only their own sessions on every `/sessions/{id}` route.
- Tenant sessions no longer fall back to operator credentials (registered keys, GITHUB_TOKEN/GITLAB_TOKEN, tool auto-fill, operator MCP servers); `provider_key` is rejected, `repo_url` must be http(s), and `workspace_session_id` must name the tenant's own session.

Webhooks:

- GitLab MR note commands (`/review`, `/fix`, `/fix-cr`) require Developer access or higher, looked up through the GitLab API with the `default_key_name` token.

Git:

- Git run by the server in a session workspace ignores workspace-controlled configuration and the global git config, runs with an allowlisted environment, and fetches/pushes only to the URL the session was cloned from. The askpass helper answers only for that host.

Runner:

- Codex prompts are passed after `--`, so they cannot be read as CLI options.

Upgrade notes:
- The GitLab `default_key_name` token needs `read_api` (or `api`).
- Server-side git ignores `~/.gitconfig`; use `GIT_SSL_CAINFO` / `SSL_CERT_FILE` or `/etc/gitconfig` for custom CAs.
- Tenant sessions need their own `access_token` for private repositories and PRs.

Images: `ghcr.io/freema/codeforge:v1.1.4`, `ghcr.io/freema/codeforge-action:v1.1.4`, `ghcr.io/freema/codeforge-ui:v1.1.4` (also tagged `latest`).

🤖 Generated with Claude Code