@vantran-se/openchamber-web 2.0.4 → 2.0.6

package/server/lib/spaces/gatekeeper-channel.js

@@ -6,6 +6,7 @@
 // curl config. It is in no argument list, on the host or inside, in no label and in no file.
 
 import { readFileSync } from 'node:fs';
+import net from 'node:net';
 
 import { SpaceError } from './errors.js';
 import {
@@ -19,6 +20,7 @@ import {
 } from './exec-http.js';
 import { ROLE_GATEKEEPER } from './labels.js';
 import {
+  GATEKEEPER_BIND_PATH,
   GATEKEEPER_CONTROL_HOST,
   GATEKEEPER_CONTROL_PORT,
   GATEKEEPER_PROGRAM_DIRECTORY,
@@ -46,13 +48,19 @@ const MAX_JOURNAL_RECORDS = 1_000;
 const MAX_JOURNAL_BODY_CHARACTERS = 1024 * 1024;
 const MAX_JOURNAL_FIELD_CHARACTERS = 256;
 
-// The program goes through a temporary name, so the waiting container never runs half a file.
+// The bind address first, then the program, each through a temporary name, so the waiting
+// container never runs half a file and never runs the program before its address is there.
 const WRITE_PROGRAM_SCRIPT = [
   IMAGE_ONLY_PATH,
   `mkdir -p ${GATEKEEPER_PROGRAM_DIRECTORY}`,
+  `&& printf '%s' "$1" > ${GATEKEEPER_BIND_PATH}.new && mv ${GATEKEEPER_BIND_PATH}.new ${GATEKEEPER_BIND_PATH}`,
   `&& cat > ${GATEKEEPER_PROGRAM_PATH}.new && mv ${GATEKEEPER_PROGRAM_PATH}.new ${GATEKEEPER_PROGRAM_PATH}`,
 ].join(' ');
 
+// A policy is three small lists. These caps are what the host is willing to read back.
+const MAX_POLICY_BODY_CHARACTERS = 256 * 1024;
+const MAX_POLICY_ENTRIES = 1_000;
+
 const pause = (milliseconds) => new Promise((resolve) => { setTimeout(resolve, milliseconds); });
 
 const unreadableAnswer = (why) => new SpaceError('gatekeeper_answer_unreadable', `The gatekeeper of the space ${why}`);
@@ -73,9 +81,18 @@ const text = (value) => (value === null || value === undefined || value instance
 export function createGatekeeperChannel({ exec, wait = pause, now = Date.now }) {
   const execInGatekeeper = (spaceId, argv, options) => exec(spaceId, argv, { ...options, target: ROLE_GATEKEEPER });
 
-  /** The program travels on stdin. It is in no argument, on the host or inside. */
-  const writeProgram = async (spaceId) => {
-    const result = await execInGatekeeper(spaceId, [IMAGE_SH, '-c', WRITE_PROGRAM_SCRIPT], { stdin: GATEKEEPER_PROGRAM });
+  /**
+   * The program travels on stdin. It is in no argument, on the host or inside. `bindAddress` is
+   * the gatekeeper's own address on the space's network, which the place read from the runtime
+   * after the container started; it goes into the file the container command names, and the
+   * program listens there and nowhere else. It is an address and not a secret, so it may be an
+   * argument of the script.
+   */
+  const writeProgram = async (spaceId, { bindAddress }) => {
+    if (net.isIP(bindAddress) === 0 || bindAddress === '0.0.0.0' || bindAddress === '::') {
+      throw new SpaceError('gatekeeper_address_unknown', 'The address of the gatekeeper on the space\'s network is not known, so its listeners cannot be bound to it.');
+    }
+    const result = await execInGatekeeper(spaceId, [IMAGE_SH, '-c', WRITE_PROGRAM_SCRIPT, 'sh', bindAddress], { stdin: GATEKEEPER_PROGRAM });
     if (result.code !== 0) {
       throw new SpaceError('gatekeeper_setup_failed', `Could not store the gatekeeper's program: ${tail(result.stderr) || `exit code ${result.code}`}`);
     }
@@ -157,8 +174,43 @@ export function createGatekeeperChannel({ exec, wait = pause, now = Date.now })
    */
   const setNetwork = (spaceId, { mode, domains = [] }) => command(spaceId, '/network', { mode, domains }, 'change the network of this space');
 
-  /** One "uses without seeing" grant. The secret is in the body, so it stays out of every argument list. */
-  const addGrant = (spaceId, { id, upstream, header, secret }) => command(spaceId, '/grants', { id, upstream, header, secret }, `add the grant '${id}'`);
+  /**
+   * One grant: a "uses without seeing" credential, whose secret is in the body and so out of every
+   * argument list, or an opened domain with no secret and no header, which the window forwards to
+   * as the space sent it.
+   */
+  const addGrant = (spaceId, { id, upstream, header = null, secret = null }) => command(
+    spaceId,
+    '/grants',
+    secret === null ? { id, upstream } : { id, upstream, header, secret },
+    `add the grant '${id}'`,
+  );
+
+  /**
+   * What the gatekeeper holds now: its mode, its allowlist and the ids of its grants, never a
+   * secret. Read as data, capped, so the host can tell a gatekeeper that forgot its grants after
+   * a start from one that has them.
+   */
+  const readPolicy = async (spaceId) => {
+    const answer = await request(spaceId, { path: '/policy' });
+    if (answer.status !== 200) throw unreadableAnswer(`answered ${answer.status} for its policy`);
+    if (answer.body.length > MAX_POLICY_BODY_CHARACTERS) throw unreadableAnswer('answered with a policy larger than the host reads');
+    let parsed;
+    try {
+      parsed = JSON.parse(answer.body);
+    } catch {
+      throw unreadableAnswer('answered with a policy that is not JSON');
+    }
+    if (!(parsed instanceof Object) || Array.isArray(parsed) || !Array.isArray(parsed.grants) || !Array.isArray(parsed.domains)) {
+      throw unreadableAnswer('answered with a policy that holds no lists');
+    }
+    const names = (list) => list.slice(0, MAX_POLICY_ENTRIES).map(text).filter((entry) => entry !== '');
+    return {
+      mode: parsed.mode === 'open' ? 'open' : 'allowlist',
+      domains: names(parsed.domains),
+      grants: names(parsed.grants),
+    };
+  };
 
   /**
    * What the gatekeeper allowed and refused. The answer comes out of a container, so it is read
@@ -195,8 +247,10 @@ export function createGatekeeperChannel({ exec, wait = pause, now = Date.now })
         };
       }),
       dropped: Number.isSafeInteger(parsed.dropped) && parsed.dropped >= 0 ? parsed.dropped : 0,
+      // When the gatekeeper started: the journal holds nothing older, and the UI has to say so.
+      since: text(parsed.since),
     };
   };
 
-  return { writeProgram, waitUntilReady, setNetwork, addGrant, readJournal };
+  return { writeProgram, waitUntilReady, setNetwork, addGrant, readPolicy, readJournal };
 }

package/server/lib/spaces/gatekeeper-channel.test.js

@@ -31,23 +31,33 @@ describe('gatekeeper channel: the program', () => {
     expect(GATEKEEPER_PROGRAM.length).toBeGreaterThan(2_000);
   });
 
-  it('travels on stdin into the tmpfs, through a temporary name, and is in no argument', async () => {
+  it('travels on stdin into the tmpfs, through a temporary name, after the bind address, and is in no argument', async () => {
     const { channel, calls } = channelWith(ok());
-    await channel.writeProgram(ID);
+    await channel.writeProgram(ID, { bindAddress: '172.19.0.2' });
 
     expect(calls).toEqual([{
       spaceId: ID,
       argv: [
         '/bin/sh', '-c',
-        'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; mkdir -p /tmp/openchamber-gatekeeper && cat > /tmp/openchamber-gatekeeper/gatekeeper.cjs.new && mv /tmp/openchamber-gatekeeper/gatekeeper.cjs.new /tmp/openchamber-gatekeeper/gatekeeper.cjs',
+        'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; mkdir -p /tmp/openchamber-gatekeeper'
+        + " && printf '%s' \"$1\" > /tmp/openchamber-gatekeeper/bind.new && mv /tmp/openchamber-gatekeeper/bind.new /tmp/openchamber-gatekeeper/bind"
+        + ' && cat > /tmp/openchamber-gatekeeper/gatekeeper.cjs.new && mv /tmp/openchamber-gatekeeper/gatekeeper.cjs.new /tmp/openchamber-gatekeeper/gatekeeper.cjs',
+        'sh', '172.19.0.2',
       ],
       options: { stdin: GATEKEEPER_PROGRAM, target: 'gatekeeper' },
     }]);
   });
 
+  // The program refuses these too; the host refuses them first, so a gatekeeper is never asked to listen everywhere.
+  it.each(['', '0.0.0.0', '::', 'gatekeeper', '172.19.0'])('refuses to write the program with %j as the bind address', async (bindAddress) => {
+    const { channel, calls } = channelWith(ok());
+    await expect(channel.writeProgram(ID, { bindAddress })).rejects.toMatchObject({ code: 'gatekeeper_address_unknown' });
+    expect(calls).toEqual([]);
+  });
+
   it('says what failed inside the gatekeeper', async () => {
     const { channel } = channelWith({ code: 1, stdout: '', stderr: 'sh: 1: cannot create: No space left on device\n' });
-    await expect(channel.writeProgram(ID)).rejects.toMatchObject({ code: 'gatekeeper_setup_failed', message: expect.stringContaining('No space left on device') });
+    await expect(channel.writeProgram(ID, { bindAddress: '172.19.0.2' })).rejects.toMatchObject({ code: 'gatekeeper_setup_failed', message: expect.stringContaining('No space left on device') });
   });
 });
 
@@ -76,6 +86,26 @@ describe('gatekeeper channel: control requests', () => {
     expect(calls[0].options.stdin).toContain(SECRET);
   });
 
+  it('sends an opened domain as a grant with no header and no secret', async () => {
+    const { channel, calls } = channelWith(ok(http(200, '{"ok":true}')));
+    await channel.addGrant(ID, { id: 'open-0a1b2c3d4e5f', upstream: 'https://registry.example.com/npm/' });
+    const data = calls[0].options.stdin.split('\n').find((line) => line.startsWith('data-raw = '));
+    expect(JSON.parse(JSON.parse(data.slice('data-raw = '.length)))).toEqual({ id: 'open-0a1b2c3d4e5f', upstream: 'https://registry.example.com/npm/' });
+  });
+
+  it('reads what the gatekeeper holds as data: mode, names and grant ids, capped, and never a secret', async () => {
+    const { channel } = channelWith(ok(http(200, JSON.stringify({ mode: 'open', domains: ['a.example.com', 7, {}], grants: ['anthropic', ['x'], 'open-1'], secret: SECRET }))));
+    expect(await channel.readPolicy(ID)).toEqual({ mode: 'open', domains: ['a.example.com', '7'], grants: ['anthropic', 'open-1'] });
+    const { channel: allowlist } = channelWith(ok(http(200, '{"mode":"anything","domains":[],"grants":[]}')));
+    expect(await allowlist.readPolicy(ID)).toEqual({ mode: 'allowlist', domains: [], grants: [] });
+    for (const body of ['not json', '[]', '{"grants":"anthropic"}', '{"grants":[]}']) {
+      const { channel: broken } = channelWith(ok(http(200, body)));
+      await expect(broken.readPolicy(ID)).rejects.toMatchObject({ code: 'gatekeeper_answer_unreadable' });
+    }
+    const { channel: refused } = channelWith(ok(http(404, '{}')));
+    await expect(refused.readPolicy(ID)).rejects.toMatchObject({ code: 'gatekeeper_answer_unreadable' });
+  });
+
   it('reports a refusal from the control channel, with what it said', async () => {
     const { channel } = channelWith(ok(http(400, '{"error":"mode is \\"allowlist\\" or \\"open\\""}')));
     await expect(channel.setNetwork(ID, { mode: 'everything', domains: [] })).rejects.toMatchObject({
@@ -119,9 +149,14 @@ describe('gatekeeper channel: control requests', () => {
 describe('gatekeeper channel: journal', () => {
   const record = { at: '2026-09-20T10:00:00.000Z', listener: 'corridor', host: 'api.anthropic.com', port: 443, decision: 'allow' };
 
-  it('reads the records and how many the ring buffer dropped', async () => {
-    const { channel } = channelWith(ok(http(200, JSON.stringify({ records: [record], dropped: 12 }))));
-    expect(await channel.readJournal(ID)).toEqual({ records: [record], dropped: 12 });
+  it('reads the records, how many the ring buffer dropped, and since when the gatekeeper records', async () => {
+    const { channel } = channelWith(ok(http(200, JSON.stringify({ records: [record], dropped: 12, since: '2026-09-20T09:00:00.000Z' }))));
+    expect(await channel.readJournal(ID)).toEqual({ records: [record], dropped: 12, since: '2026-09-20T09:00:00.000Z' });
+  });
+
+  it('leaves "since" empty for a gatekeeper that does not say, and never takes an object for it', async () => {
+    const { channel } = channelWith(ok(http(200, JSON.stringify({ records: [], dropped: 0, since: { at: 1 } }))));
+    expect(await channel.readJournal(ID)).toEqual({ records: [], dropped: 0, since: '' });
   });
 
   it('keeps the five fields of a record and nothing else the gatekeeper sends', async () => {
@@ -168,6 +203,7 @@ describe('gatekeeper channel: journal', () => {
         { at: '', listener: '', host: '', port: 0, decision: '' },
       ],
       dropped: 0,
+      since: '',
     });
   });
 });

package/server/lib/spaces/gatekeeper-program.cjs

@@ -14,18 +14,22 @@
 // Arguments: <space-facing bind host> <corridor port> <window port> <control port>
 // [<window deadline in ms>]. They are arguments so that the container command and the tests run
 // the very same program; the last one lets a test watch a deadline pass without waiting five
-// minutes for it. None of them changes a decision this program makes.
+// minutes for it. None of them changes a decision this program makes. The bind host is an
+// address, or the path of a file that holds one: the container command names the file, and the
+// host writes the gatekeeper's own address on the space's network into it before the program,
+// because the host knows that address and this program has no say in where it listens.
 //
 // Everything the space sends is hostile input. Nothing it can send may end the process:
 // a crash of the gatekeeper is a denial of service the agent could trigger at will.
 
 const dns = require('node:dns');
+const fs = require('node:fs');
 const http = require('node:http');
 const https = require('node:https');
 const net = require('node:net');
 const os = require('node:os');
 
-const [bindHost, corridorPort, windowPort, controlPort, windowDeadline, corridorCap, windowCap, controlCap] = process.argv.slice(2);
+const [bindArgument, corridorPort, windowPort, controlPort, windowDeadline, corridorCap, windowCap, controlCap] = process.argv.slice(2);
 
 /**
  * A cap given on the command line, or the production number when there is none.
@@ -105,12 +109,42 @@ const GRANT_ID_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
 const HEADER_NAME_PATTERN = /^[A-Za-z0-9-]{1,64}$/;
 const MAX_SECRET_LENGTH = 8192;
 
+/**
+ * The address the corridor and the window listen on. An argument that starts with `/` is the
+ * file the host wrote beside this program, holding the gatekeeper's own address on the space's
+ * network; anything else is the address itself, which is what the tests pass. Whichever it is,
+ * it must be the address of one interface: a file that is missing or empty, or anything that is
+ * not an address or names every interface, ends the program. On a Linux Docker host every local
+ * process can reach the bridge, and a window that listens there spends the user's key for anyone
+ * on the machine. That includes a gatekeeper made before stage 5b, whose command still says
+ * `0.0.0.0` and whose checker never compared the command: it no longer starts, and such a
+ * space has to be made again. Failing to start is the safe answer.
+ */
+function readBindHost(argument) {
+  const given = String(argument ?? '');
+  let text = given;
+  if (given.startsWith('/')) {
+    try {
+      text = fs.readFileSync(given, 'utf8').trim();
+    } catch (error) {
+      console.error(`gatekeeper: cannot read the bind address from ${given} (${error.code || error.message})`);
+      process.exit(2);
+    }
+  }
+  if (net.isIP(text) === 0 || text === '0.0.0.0' || text === '::') {
+    console.error(`gatekeeper: ${given} is not the address of one interface`);
+    process.exit(2);
+  }
+  return text;
+}
 // Everything the host sets, in memory only. Never a file, never an environment variable,
 // never an argument, never a label. A restart starts from "nothing is allowed".
 let networkMode = 'allowlist';
 let allowedDomains = new Set();
 const grants = new Map();
 
+// When this program started, for the journal: nothing before it is on record.
+const STARTED_AT = new Date().toISOString();
 const journal = [];
 let journalDropped = 0;
 
@@ -604,9 +638,9 @@ const answerJson = (response, status, body) => {
  * The gatekeeper's own listeners are not an upstream. A grant is the host's decision, and the
  * user's private network is a legitimate place for one, so only this refusal stands in the way.
  *
- * Every address this container has, not only loopback: the corridor and the window bind
- * `0.0.0.0`, so the address the space reaches them on is the one on the inner network, and a
- * grant pointing there would feed the window into itself until its 64 sockets out were gone.
+ * Every address this container has, not only loopback: the corridor and the window listen on
+ * the gatekeeper's address on the inner network, and a grant pointing there, or at any other
+ * address of its own, would feed the window into itself until its 64 sockets out were gone.
  */
 const ownListenerPorts = new Set([Number(corridorPort), Number(windowPort), Number(controlPort)]);
 const ownAddresses = new Set(Object.values(os.networkInterfaces())
@@ -665,13 +699,18 @@ async function serveWindow(request, response) {
     return;
   }
 
-  // Whatever the space sent as credentials goes, and the grant's own header takes its place.
+  // Whatever the space sent as credentials goes, and the grant's own header takes its place. A
+  // grant without a secret, an opened domain, adds nothing: the upstream sees the request as the
+  // space made it, less the credential headers.
   const headers = { ...request.headers };
   for (const name of Object.keys(headers)) {
-    if (['authorization', 'x-api-key', 'proxy-authorization'].includes(name.toLowerCase())) delete headers[name];
+    const lower = name.toLowerCase();
+    if (['authorization', 'x-api-key', 'proxy-authorization'].includes(lower) || lower === grant.header) delete headers[name];
   }
   headers.host = upstream.host;
-  headers[grant.header] = grant.header.toLowerCase() === 'authorization' ? `Bearer ${grant.secret}` : grant.secret;
+  if (grant.secret !== null) {
+    headers[grant.header] = grant.header === 'authorization' ? `Bearer ${grant.secret}` : grant.secret;
+  }
 
   record('window', normalizeName(upstream.hostname), port, 'allow');
   const transport = upstream.protocol === 'https:' ? https : http;
@@ -757,13 +796,19 @@ function setNetwork(body) {
   return null;
 }
 
+/**
+ * A grant with a secret names the header that carries it; a grant without one, an opened domain,
+ * names no header and the window adds nothing. A body with a header and no secret, or a secret
+ * and no header, is refused: either the grant hides a credential or it does not.
+ */
 function addGrant(body) {
   const id = asText(body.id);
-  const header = asText(body.header);
-  const secret = asText(body.secret);
   if (!GRANT_ID_PATTERN.test(id)) return 'a grant id is 1 to 64 letters, digits, dots, dashes or underscores';
-  if (!HEADER_NAME_PATTERN.test(header)) return 'a header name is 1 to 64 letters, digits or dashes';
-  if (secret.length === 0 || secret.length > MAX_SECRET_LENGTH) return 'a grant needs a secret';
+  const withSecret = body.secret !== undefined || body.header !== undefined;
+  const header = withSecret ? asText(body.header).toLowerCase() : null;
+  const secret = withSecret ? asText(body.secret) : null;
+  if (withSecret && !HEADER_NAME_PATTERN.test(header)) return 'a header name is 1 to 64 letters, digits or dashes';
+  if (withSecret && (secret.length === 0 || secret.length > MAX_SECRET_LENGTH)) return 'a grant with a header needs a secret';
   let upstream;
   try {
     upstream = new URL(asText(body.upstream));
@@ -782,8 +827,15 @@ async function serveControl(request, response) {
     answerJson(response, 200, { ready: true, mode: networkMode, domains: allowedDomains.size, grants: grants.size });
     return;
   }
+  if (request.method === 'GET' && path === '/policy') {
+    // What the host last said, so it can tell a gatekeeper that forgot from one that remembers.
+    // Ids and names only: a secret is never read back, not even by the host.
+    answerJson(response, 200, { mode: networkMode, domains: Array.from(allowedDomains), grants: Array.from(grants.keys()) });
+    return;
+  }
   if (request.method === 'GET' && path === '/journal') {
-    answerJson(response, 200, { records: journal.slice(), dropped: journalDropped });
+    // Since when: the journal is memory only, so the host says that nothing older exists.
+    answerJson(response, 200, { records: journal.slice(), dropped: journalDropped, since: STARTED_AT });
     return;
   }
   if (request.method !== 'POST' || (path !== '/network' && path !== '/grants')) {
@@ -874,6 +926,8 @@ const control = makeServer('control', MAX_CONTROL_CONNECTIONS, (request, respons
 const listen = (server, port, host) => new Promise((resolve) => { server.listen(Number(port), host, resolve); });
 
 async function main() {
+  // Here and not at the top: requiring this file from a test must not read the runner's argv.
+  const bindHost = readBindHost(bindArgument);
   if (!bindHost || !corridorPort || !windowPort || !controlPort) {
     console.error('gatekeeper: arguments are <bind host> <corridor port> <window port> <control port>');
     process.exit(2);
@@ -910,5 +964,5 @@ function describeFailure(error) {
 if (require.main === module) {
   main();
 } else {
-  module.exports = { chooseAddress, isBlockedAddress, isDomainName, joinSockets, parseIPv4, parseIPv6, refuseTarget, setNetwork, splitTarget, walksOutOfGrant };
+  module.exports = { addGrant, chooseAddress, isBlockedAddress, isDomainName, joinSockets, parseIPv4, parseIPv6, refuseTarget, setNetwork, splitTarget, walksOutOfGrant };
 }

package/server/lib/spaces/gatekeeper-program.test.js

@@ -4,13 +4,14 @@
 // The corridor refuses every address that leads back to a machine, so a tunnel that really
 // carries bytes cannot be tested from here. The escape suite does that inside real containers.
 
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
 import http from 'node:http';
 import net from 'node:net';
 import os from 'node:os';
-import { readFileSync } from 'node:fs';
+import fs, { readFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
+import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest';
@@ -748,6 +749,28 @@ describe('gatekeeper program', () => {
       expect(answer.body).not.toContain(SECRET);
     });
 
+    it('adds no header for a grant without a secret, and still takes away what the space sent', async () => {
+      expect((await control('POST', '/grants', { id: 'open-registry', upstream: `http://127.0.0.1:${upstreamPort}/npm` })).status).toBe(200);
+      const answer = await throughWindow('/model/open-registry/-/package/left-pad', {
+        authorization: 'Bearer sk-fake-inside',
+        'x-api-key': 'sk-fake-inside',
+        'x-keep-me': 'yes',
+      });
+      expect(answer.status).toBe(200);
+      const request = seen.at(-1);
+      expect(request.url).toBe('/npm/-/package/left-pad');
+      expect(request.headers.authorization).toBeUndefined();
+      expect(request.headers['x-api-key']).toBeUndefined();
+      expect(request.headers['x-keep-me']).toBe('yes');
+      expect(Object.keys(request.headers).some((name) => /key|auth|token/i.test(name))).toBe(false);
+    });
+
+    it('takes the grant\'s own header name away too, so a placeholder the space sends never reaches the upstream', async () => {
+      expect((await control('POST', '/grants', { id: 'google', upstream: `http://127.0.0.1:${upstreamPort}/v1`, header: 'X-Goog-Api-Key', secret: SECRET })).status).toBe(200);
+      await throughWindow('/model/google/models', { 'X-Goog-Api-Key': 'space-window' });
+      expect(seen.at(-1).headers['x-goog-api-key']).toBe(SECRET);
+    });
+
     it('sends a bearer token for an OpenAI-style grant', async () => {
       await throughWindow('/model/openai/responses');
       expect(seen.at(-1).headers.authorization).toBe(`Bearer ${SECRET}`);
@@ -873,7 +896,9 @@ describe('gatekeeper program', () => {
       ['a numeric last label on the allowlist', '/network', { mode: 'allowlist', domains: ['1.1.1'] }],
       ['a hex last label on the allowlist', '/network', { mode: 'allowlist', domains: ['a.com.0x2'] }],
       ['a single-label name on the allowlist', '/network', { mode: 'allowlist', domains: ['localhost'] }],
-      ['a grant without a secret', '/grants', { id: 'x', upstream: 'https://api.example.com', header: 'authorization' }],
+      ['a grant with a header and no secret', '/grants', { id: 'x', upstream: 'https://api.example.com', header: 'authorization' }],
+      ['a grant with a secret and no header', '/grants', { id: 'x', upstream: 'https://api.example.com', secret: SECRET }],
+      ['a grant with an empty secret', '/grants', { id: 'x', upstream: 'https://api.example.com', header: 'authorization', secret: '' }],
       ['a grant with an id that is not one', '/grants', { id: '../../etc', upstream: 'https://api.example.com', header: 'authorization', secret: SECRET }],
       ['a grant with a header name that is not one', '/grants', { id: 'x', upstream: 'https://api.example.com', header: 'a: b', secret: SECRET }],
       ['a grant whose upstream is not a URL', '/grants', { id: 'x', upstream: 'not a url', header: 'authorization', secret: SECRET }],
@@ -883,6 +908,14 @@ describe('gatekeeper program', () => {
       expect(answer.status).toBe(400);
     });
 
+    it('says what it holds: the mode, the names and the grant ids, and never a secret', async () => {
+      expect((await control('POST', '/network', { mode: 'allowlist', domains: ['Example.com.', 'example.org'] })).status).toBe(200);
+      const policy = JSON.parse((await control('GET', '/policy')).body);
+      expect(policy).toMatchObject({ mode: 'allowlist', domains: ['example.com', 'example.org'] });
+      expect(policy.grants).toEqual(expect.arrayContaining(['anthropic', 'openai']));
+      expect(JSON.stringify(policy)).not.toContain(SECRET);
+    });
+
     it('answers 404 for anything else and 400 for a body that is not JSON', async () => {
       expect((await control('GET', '/grants')).status).toBe(404);
       expect((await control('POST', '/anything')).status).toBe(404);
@@ -958,6 +991,9 @@ describe('gatekeeper program', () => {
       const after = await journal();
       expect(after.records).toHaveLength(500);
       expect(after.dropped).toBeGreaterThan(before.dropped);
+      // Since when it records: its own start, as an instant, so the host can say that nothing older exists.
+      expect(after.since).toMatch(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/);
+      expect(after.since).toBe(before.since);
       // The oldest records went, the newest stayed.
       expect(after.records.at(-1).host).toBe('blocked.test');
     }, 60_000);
@@ -1340,6 +1376,85 @@ describe('the rules of the gatekeeper program', () => {
   });
 });
 
+describe('the gatekeeper program and its bind address', () => {
+  const folders = [];
+  afterAll(() => { for (const folder of folders) fs.rmSync(folder, { recursive: true, force: true }); });
+
+  /** Starts the program with `bind` as its first argument and waits for it to listen or to leave. */
+  const startWith = (bind, ports = ['0', '0', '0']) => new Promise((resolve) => {
+    const child = spawn(process.execPath, [PROGRAM, bind, ...ports.map(String)], { stdio: ['ignore', 'pipe', 'pipe'] });
+    let output = '';
+    const finish = (outcome) => { resolve({ ...outcome, output, stop: () => child.kill() }); };
+    child.stdout.on('data', (chunk) => { output += chunk; if (output.includes('gatekeeper: corridor')) finish({ exited: null }); });
+    child.stderr.on('data', (chunk) => { output += chunk; });
+    child.on('exit', (code) => finish({ exited: code }));
+  });
+
+  /** One TCP connect: `connected` or the error code. */
+  const tryConnect = (host, port) => new Promise((resolve) => {
+    const socket = net.connect({ host, port });
+    socket.setTimeout(3000, () => { socket.destroy(); resolve('timeout'); });
+    socket.on('connect', () => { socket.destroy(); resolve('connected'); });
+    socket.on('error', (error) => resolve(error.code));
+  });
+
+  it('listens on the address the file beside it holds, and on nothing else', async () => {
+    const other = ownAddress();
+    // Without a second address of this machine there is nothing to be refused on.
+    expect(other, 'this machine has no address but loopback').not.toBe('127.0.0.1');
+    const folder = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-gatekeeper-bind-'));
+    folders.push(folder);
+    const file = path.join(folder, 'bind');
+    fs.writeFileSync(file, '127.0.0.1\n');
+    const ports = [await freePort(), await freePort(), await freePort()];
+    const started = await startWith(file, ports);
+    try {
+      expect(started.exited).toBeNull();
+      // Positive control: the address in the file answers on both listeners the space uses.
+      expect(await tryConnect('127.0.0.1', ports[0])).toBe('connected');
+      expect(await tryConnect('127.0.0.1', ports[1])).toBe('connected');
+      // Another address of the same machine does not: the program did not listen everywhere.
+      expect(await tryConnect(other, ports[0])).toBe('ECONNREFUSED');
+      expect(await tryConnect(other, ports[1])).toBe('ECONNREFUSED');
+    } finally {
+      started.stop();
+    }
+  });
+
+  it('reads no bind file when it is required rather than run, whatever the runner\'s arguments are', () => {
+    // `node -e` puts its own arguments from argv[1], so the path lands where the program reads its bind argument.
+    // A runner whose first argument is a path would otherwise have its file read, and a
+    // missing one would end the test process.
+    const required = spawnSync(process.execPath, ['-e', `require(${JSON.stringify(PROGRAM)}); console.log('still here')`, 'runner', '/no/such/bind/file'], { encoding: 'utf8' });
+    expect(required.status).toBe(0);
+    expect(required.stdout).toContain('still here');
+  });
+
+  // A gatekeeper made before stage 5b has `0.0.0.0` in its command rather than the file.
+  it.each(['0.0.0.0', '::', 'gatekeeper'])('does not start when it is told to listen on %j directly', async (bind) => {
+    const started = await startWith(bind);
+    expect(started.exited).toBe(2);
+    expect(started.output).not.toContain('gatekeeper: corridor');
+  });
+
+  it.each([
+    ['is missing', null],
+    ['is empty', ''],
+    ['names every interface', '0.0.0.0'],
+    ['names every IPv6 interface', '::'],
+    ['is not an address', 'gatekeeper'],
+  ])('does not start when the bind file %s', async (title, content) => {
+    const folder = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-gatekeeper-bind-'));
+    folders.push(folder);
+    const file = path.join(folder, 'bind');
+    if (content !== null) fs.writeFileSync(file, content);
+    const started = await startWith(file);
+    expect(started.exited).toBe(2);
+    expect(started.output).toContain('gatekeeper:');
+    expect(started.output).not.toContain('gatekeeper: corridor');
+  });
+});
+
 describe('the gatekeeper program as a file', () => {
   const source = readFileSync(PROGRAM, 'utf8');
 

package/server/lib/spaces/hardening.js

@@ -44,8 +44,19 @@ const SETUP_MEMORY_BYTES = 128 * 1024 * 1024;
 // Measured: the cache of one fill is 444 MB.
 const FILLER_MEMORY_BYTES = 2 * 1024 * 1024 * 1024;
 const FILLER_TMPFS_OPTIONS = 'rw,exec,nosuid,size=1g';
-// Variables that would put a secret where `docker inspect` shows it.
-const FORBIDDEN_ENVIRONMENT = ['OPENCHAMBER_UI_PASSWORD', 'OPENCODE_AUTH_CONTENT'];
+// The container environment is an allowlist. Anything in it is readable through `docker inspect`
+// and by every process inside, and OpenCode 2 turns some variables into a login: a provider key
+// under one of its catalog's names, or a key inside OPENCODE_CONFIG_CONTENT. So a container may
+// carry the variables we set and the base image's own, and nothing else. The server password is
+// named on its own as well, so its message stays specific.
+const FORBIDDEN_ENVIRONMENT = ['OPENCHAMBER_UI_PASSWORD'];
+// The variables the pinned base image sets itself. Docker copies them into every container made
+// from it. Read on 2026-09-24 with
+// `docker image inspect <SPACE_BASE_IMAGE> --format '{{json .Config.Env}}'`, which answered
+// PATH, NODE_VERSION=22.23.2 and YARN_VERSION=1.22.22. Read them again when the digest changes.
+const BASE_IMAGE_ENVIRONMENT_NAMES = ['PATH', 'NODE_VERSION', 'YARN_VERSION'];
+const SPACE_ENVIRONMENT_NAMES = new Set([...Object.keys(SPACE_ENVIRONMENT), ...BASE_IMAGE_ENVIRONMENT_NAMES]);
+const GATEKEEPER_ENVIRONMENT_NAMES = new Set([...Object.keys(GATEKEEPER_ENVIRONMENT), ...BASE_IMAGE_ENVIRONMENT_NAMES]);
 
 // Container output lands in a file on the Docker host. One 10 MB file, no rotation copies.
 // The `local` driver refuses max-file=1 unless compression is off.
@@ -265,7 +276,7 @@ const mentionsRuntimeSocket = (text) => String(text ?? '').includes('docker.sock
  * the tmpfs, the network the container must run on, and which mounts it may have, which
  * `mountViolations(mounts)` answers.
  */
-function findCommonViolations({ container, tmpfsOptions, networkMode, mountViolations }) {
+function findCommonViolations({ container, tmpfsOptions, networkMode, mountViolations, allowedEnvironment }) {
   const violations = [];
   const violate = (check, message) => violations.push({ check, message });
 
@@ -273,8 +284,11 @@ function findCommonViolations({ container, tmpfsOptions, networkMode, mountViola
   const host = container?.HostConfig ?? {};
   const mounts = container?.Mounts ?? [];
 
-  const secretVariables = (config.Env ?? []).map((entry) => String(entry).split('=')[0]).filter((name) => FORBIDDEN_ENVIRONMENT.includes(name));
+  const variableNames = (config.Env ?? []).map((entry) => String(entry).split('=')[0]);
+  const secretVariables = variableNames.filter((name) => FORBIDDEN_ENVIRONMENT.includes(name));
   if (secretVariables.length > 0) violate('environment', `The container environment holds a secret: ${secretVariables.join(', ')}`);
+  const unexpectedVariables = variableNames.filter((name) => !FORBIDDEN_ENVIRONMENT.includes(name) && !allowedEnvironment.has(name));
+  if (unexpectedVariables.length > 0) violate('environment', `The container environment holds variables nobody set for it: ${unexpectedVariables.join(', ')}`);
   if (config.User !== SPACE_USER) violate('user', `Runs as '${config.User ?? ''}', expected ${SPACE_USER}`);
   if (host.ReadonlyRootfs !== true) violate('read_only', 'The root filesystem is writable');
   if (host.Privileged !== false) violate('privileged', 'The container is privileged');
@@ -374,6 +388,7 @@ export function findHardeningViolations({ spaceId, owner, container, network, to
     tmpfsOptions: TMPFS_OPTIONS,
     networkMode: networkName,
     mountViolations: (mounts) => findSpaceMountViolations({ mounts, prefix, owner, toolsVolume }),
+    allowedEnvironment: SPACE_ENVIRONMENT_NAMES,
   });
   const violate = (check, message) => violations.push({ check, message });
 
@@ -427,6 +442,7 @@ export function findGatekeeperHardeningViolations({ spaceId, owner, container, o
       check: 'mounts',
       message: `The gatekeeper has ${mounts.length} mount(s) and must have none: ${mounts.map((mount) => mount.Destination).join(', ')}`,
     }]),
+    allowedEnvironment: GATEKEEPER_ENVIRONMENT_NAMES,
   });
   const violate = (check, message) => violations.push({ check, message });