wood-fired-tasks 2.2.0 → 2.3.0

package/AGENTS.md

@@ -68,6 +68,16 @@ Treat these as off-limits unless your task explicitly requires touching them.
 - `/bin/` — gitignored client install artifacts. `bin/tasks.cmd` may contain a **baked-in API key** from a local install; do not commit, share, or read its contents into context.
 - `.planning/`, `.claude/`, `.codex/`, `.agents/`, `.bug-smash-*.md` — gitignored workspace dirs. Not part of the shipped repo; do not rely on them.
 
+## Trust boundary for static / security reviewers
+
+If you are evaluating the **trust** of this checkout (static or security review of a repo you do **not** operate), READ the repo — do **not** execute its host-mutating or package-executing flows. These are intentional, trusted-operator operations and are individually banner-marked at their definition:
+
+- `tasks self-update` / `/tasks:update` ([`skills/tasks/update.md`](skills/tasks/update.md)) — global npm install that mutates the installed CLI.
+- The loop's artifact-level distributable smoke ([`skills/tasks/loop-shared.md`](skills/tasks/loop-shared.md) §O.2b) — `npm pack`, temp-prefix global install, and running the shipped binary.
+- Deployment scripts ([`deploy/`](deploy/README.md)) — `sudo`, systemd service control, DB migrations/restores, production dependency installs.
+
+Running any of the above against an untrusted checkout executes repo-authored code with real side effects. A trust review's job is to read and reason about these paths, never to run them.
+
 ## Deeper docs
 
 | File | One-line purpose |

package/CHANGELOG.md

@@ -11,6 +11,46 @@ vulnerabilities, supply-chain pinning) are always called out under `Security`.
 
 ## [Unreleased]
 
+## [v2.3.0] - 2026-06-27
+
+Security-hardening release remediating issues #74, #72, and #75 (reported by the
+Stafficy agent). All changes are backward compatible — defaults reproduce prior
+behavior.
+
+### Added
+- **Proxy-aware rate limiting** (#75). New `TRUST_PROXY` env var (default **off**;
+  accepts `true`, an integer hop count, or a comma-separated IP/CIDR allowlist)
+  wired into the Fastify factory so `request.ip` derives from `X-Forwarded-For`
+  only when a proxy is trusted. The rate limiter gains an explicit `keyGenerator`
+  that keys on the authenticated principal when present, else `request.ip`.
+- **Per-route auth/device rate limits** (#75). `/auth/login`, `/auth/callback`,
+  `/auth/device/code`, and `/auth/device/verify` get a tighter budget
+  (`RATE_LIMIT_AUTH_MAX`, default 10); `/auth/device/token` gets a looser one for
+  CLI polling (`RATE_LIMIT_DEVICE_TOKEN_MAX`, default 30). `RATE_LIMIT_MAX` and
+  `RATE_LIMIT_TIME_WINDOW` are now part of the validated `src/config/env.ts`
+  schema instead of raw `process.env` reads.
+
+### Security
+- **Slack mrkdwn injection** (#74). User-controlled task/project/comment text
+  (titles, descriptions, names, comment author + body, assignee, tags) is now
+  escaped via a new `escapeSlackMrkdwn` helper before being placed in Slack
+  mrkdwn — including the broadcast notification path. Prevents injected Slack
+  mentions (`<!channel>`) and spoofed links from appearing in trusted-looking
+  notifications. System-owned fields (ids, status/priority enums) are unaffected.
+- **`triggers.yaml` trust boundary enforced** (#72, wft-router). The router now
+  rejects its `triggers.yaml` at startup if it is group/other-accessible
+  (`mode & 0o077`) or, on POSIX, not owned by the router user — the path is
+  realpath-resolved so a benign symlink to an attacker-writable target is also
+  rejected. Closes the gap where `docs/event-router-design.md` documented `0600`
+  enforcement that did not exist. Windows skips the check (documented deployment
+  requirement). Since `triggers.yaml` can run `shell_exec` and arbitrary webhook
+  egress, this restores the documented edit-equals-code-execution trust boundary.
+- **Rate-limit hardening for auth routes** (#75). Sensitive auth/device endpoints
+  no longer share the broad global budget, narrowing brute-force and
+  user-code-enumeration surface; proxy-aware keying prevents all clients behind a
+  reverse proxy from collapsing into one bucket (accidental DoS / uneven
+  protection).
+
 ## [v2.2.0] - 2026-06-11
 
 ### Added

package/SECURITY.md

@@ -14,11 +14,11 @@ security updates. Older tags are provided as-is.
 | Version           | Supported          |
 | ----------------- | ------------------ |
 | `main` (HEAD)     | :white_check_mark: |
-| `v2.2.0` (latest) | :white_check_mark: |
-| `v1.0` – `v2.0.6` | :x:                |
+| `v2.3.0` (latest) | :white_check_mark: |
+| `v1.0` – `v2.2.0` | :x:                |
 
 "Latest" tracks whichever tag is most recent on GitHub; at the time of
-writing that is `v2.2.0`. If you are reading this on an older checkout,
+writing that is `v2.3.0`. If you are reading this on an older checkout,
 verify the current latest release via
 `git tag --sort=-creatordate | head -1` or the GitHub Releases page.
 

package/dist/api/routes/auth/callback.js

@@ -1,8 +1,18 @@
 import { handleCallback } from '../../../services/oidc-client.js';
 import { upsertFromOidc } from '../../../services/user-upsert.js';
 import { toAuthenticatedUser } from '../../plugins/auth/strategies/pat.js';
+import { config } from '../../../config/env.js';
 const callbackRoute = async (fastify, opts) => {
-    fastify.get('/callback', { config: { skipAuth: true } }, async (request, reply) => {
+    // Issue #75 — tighter per-route rate limit (auth surface hardening).
+    fastify.get('/callback', {
+        config: {
+            skipAuth: true,
+            rateLimit: {
+                max: config.RATE_LIMIT_AUTH_MAX,
+                timeWindow: config.RATE_LIMIT_AUTH_TIME_WINDOW,
+            },
+        },
+    }, async (request, reply) => {
         const handshake = request.session.get('oidc.handshake');
         if (!handshake) {
             request.log.error({ requestId: request.id, peerIp: request.ip }, 'oidc.handshake_missing');

package/dist/api/routes/auth/device-code.d.ts

@@ -42,6 +42,16 @@ export interface DeviceCodeRouteOptions {
      * one OIDC_CLIENT_ID; we reject anything else).
      */
     expectedClientId: string;
+    /**
+     * Issue #68 (finding 2) — optional allowlist of hostnames the per-request
+     * verification origin may be built from (sourced from
+     * `env.DEVICE_FLOW_TRUSTED_HOSTS`). When non-empty, a request whose
+     * `Host` / `X-Forwarded-Host` is not in the list is ignored and the
+     * verification URI falls back to the configured {@link origin}. When
+     * empty/undefined (default) every Host is honored — backward compatible.
+     * Hostnames only (no port); the resolver strips any `:port` before matching.
+     */
+    trustedHosts?: readonly string[];
 }
 /**
  * Resolve the origin (`scheme://host[:port]`) the CLIENT used to reach this
@@ -58,10 +68,16 @@ export interface DeviceCodeRouteOptions {
  * is returned ONLY to the same client that sent the request, so a spoofed Host
  * merely misdirects the spoofer. Falls back to `fallback` (the configured
  * origin) when no Host header is present at all.
+ *
+ * Issue #68 (finding 2) — an operator who wants to pin the trust boundary may
+ * pass `trustedHosts` (from `env.DEVICE_FLOW_TRUSTED_HOSTS`). When that list is
+ * non-empty, a Host whose hostname is NOT on it is refused and we fall back to
+ * the configured `fallback` origin rather than echoing an arbitrary header.
+ * When the list is empty/omitted the behavior is unchanged (every Host honored).
  */
 export declare function resolveVerificationOrigin(request: {
     headers: Record<string, string | string[] | undefined>;
     protocol?: string;
-}, fallback: string): string;
+}, fallback: string, trustedHosts?: readonly string[]): string;
 declare const deviceCodeRoute: FastifyPluginAsync<DeviceCodeRouteOptions>;
 export default deviceCodeRoute;

package/dist/api/routes/auth/device-code.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { createSession } from '../../../services/device-flow-store.js';
+import { config } from '../../../config/env.js';
 /** First value of a possibly comma-joined / array-valued HTTP header. */
 function firstHeaderValue(v) {
     const raw = Array.isArray(v) ? v[0] : v;
@@ -23,12 +24,25 @@ function firstHeaderValue(v) {
  * is returned ONLY to the same client that sent the request, so a spoofed Host
  * merely misdirects the spoofer. Falls back to `fallback` (the configured
  * origin) when no Host header is present at all.
+ *
+ * Issue #68 (finding 2) — an operator who wants to pin the trust boundary may
+ * pass `trustedHosts` (from `env.DEVICE_FLOW_TRUSTED_HOSTS`). When that list is
+ * non-empty, a Host whose hostname is NOT on it is refused and we fall back to
+ * the configured `fallback` origin rather than echoing an arbitrary header.
+ * When the list is empty/omitted the behavior is unchanged (every Host honored).
  */
-export function resolveVerificationOrigin(request, fallback) {
+export function resolveVerificationOrigin(request, fallback, trustedHosts = []) {
     const host = firstHeaderValue(request.headers['x-forwarded-host']) ??
         firstHeaderValue(request.headers['host']);
     if (!host)
         return fallback;
+    // When an allowlist is configured, the Host's hostname (sans :port) must be
+    // on it; otherwise refuse the header and use the configured origin.
+    if (trustedHosts.length > 0) {
+        const hostname = (host.split(':')[0] ?? host).toLowerCase();
+        if (!trustedHosts.includes(hostname))
+            return fallback;
+    }
     const scheme = firstHeaderValue(request.headers['x-forwarded-proto']) ??
         (request.protocol && request.protocol.length > 0 ? request.protocol : 'http');
     return `${scheme}://${host}`;
@@ -44,7 +58,16 @@ const BodySchema = z.object({
     scope: z.string().optional(),
 });
 const deviceCodeRoute = async (fastify, opts) => {
-    fastify.post('/auth/device/code', { config: { skipAuth: true } }, async (request, reply) => {
+    // Issue #75 — tighter per-route rate limit (auth surface hardening).
+    fastify.post('/auth/device/code', {
+        config: {
+            skipAuth: true,
+            rateLimit: {
+                max: config.RATE_LIMIT_AUTH_MAX,
+                timeWindow: config.RATE_LIMIT_AUTH_TIME_WINDOW,
+            },
+        },
+    }, async (request, reply) => {
         // Manual Zod parse so the error envelope matches RFC 8628 verbatim
         // (`{error: 'invalid_request'}`) — Fastify's default 400 carries the
         // `statusCode/error/message` triplet which is not what RFC 8628 wants.
@@ -73,7 +96,7 @@ const deviceCodeRoute = async (fastify, opts) => {
         // #834: build the verification URL from the address the CLIENT connected to
         // (request Host / X-Forwarded-*), not the static configured origin, so a
         // remote/LAN client gets a URL it can actually open instead of localhost.
-        const origin = resolveVerificationOrigin(request, opts.origin);
+        const origin = resolveVerificationOrigin(request, opts.origin, opts.trustedHosts ?? []);
         return reply.code(200).send({
             device_code: session.deviceCode,
             user_code: session.userCode,

package/dist/api/routes/auth/device-html.js

@@ -3,6 +3,7 @@ import { renderDevicePage, renderDeviceApprovedPage } from '../../../web/pages/d
 import { getOrCreateCsrfToken, verifyCsrfToken } from './csrf.js';
 import { requireUser } from '../../plugins/auth.js';
 import { generateToken } from '../../../services/pat-hash.js';
+import { config } from '../../../config/env.js';
 /**
  * Strict alphabet check for `?user_code=`. MUST match the alphabet used by
  * device-flow-store's generator: 31 confusable-free uppercase chars,
@@ -70,7 +71,16 @@ const deviceHtmlRoute = async (fastify, opts) => {
     //   4. Success → approve() then renderDeviceApprovedPage(). Logger emits
     //      `event: device_flow_approved` with the userId — user_code is
     //      DELIBERATELY OMITTED from the log payload (Threat T-30-02-06).
-    fastify.post('/auth/device/verify', { config: { sessionOnly: true } }, async (request, reply) => {
+    // Issue #75 — tighter per-route rate limit (auth surface hardening).
+    fastify.post('/auth/device/verify', {
+        config: {
+            sessionOnly: true,
+            rateLimit: {
+                max: config.RATE_LIMIT_AUTH_MAX,
+                timeWindow: config.RATE_LIMIT_AUTH_TIME_WINDOW,
+            },
+        },
+    }, async (request, reply) => {
         const body = (request.body ?? {});
         // 1. CSRF gate.
         if (!verifyCsrfToken(request, body._csrf)) {

package/dist/api/routes/auth/device-token.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { findByDeviceCode, remove } from '../../../services/device-flow-store.js';
 import { toAuthenticatedUser } from '../../plugins/auth/strategies/pat.js';
+import { config } from '../../../config/env.js';
 /** RFC 8628 §3.4 grant_type literal. */
 const DEVICE_CODE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
 /**
@@ -20,7 +21,19 @@ const deviceTokenRoute = async (fastify, opts) => {
     if (!fastify.hasDecorator('userRepository')) {
         throw new Error('deviceTokenRoute requires userRepository to be decorated before registration');
     }
-    fastify.post('/auth/device/token', { config: { skipAuth: true } }, async (request, reply) => {
+    // Issue #75 — the CLI polls this endpoint every `interval` seconds, so it
+    // gets a looser per-route budget than the other auth routes (still well
+    // below the global max). Env-tunable via RATE_LIMIT_DEVICE_TOKEN_MAX /
+    // RATE_LIMIT_AUTH_TIME_WINDOW.
+    fastify.post('/auth/device/token', {
+        config: {
+            skipAuth: true,
+            rateLimit: {
+                max: config.RATE_LIMIT_DEVICE_TOKEN_MAX,
+                timeWindow: config.RATE_LIMIT_AUTH_TIME_WINDOW,
+            },
+        },
+    }, async (request, reply) => {
         // request.body is either the parsed JSON object OR the formbody plugin's
         // parsed URLSearchParams shape — both surface as plain objects to Zod.
         const parsed = BodySchema.safeParse(request.body);

package/dist/api/routes/auth/login.js

@@ -1,4 +1,5 @@
 import { buildAuthorizationUrl, calculatePKCECodeChallenge, randomNonce, randomPKCECodeVerifier, randomState, } from '../../../services/oidc-client.js';
+import { config } from '../../../config/env.js';
 /**
  * Validates `?next=<path>` for open-redirect safety. Pattern: a SINGLE
  * leading slash followed by ANY character that is NOT another slash AND
@@ -33,7 +34,18 @@ const NEXT_PATH_RE = /^\/[^/\\]/;
  */
 const DEVICE_NEXT_RE = /^\/auth\/device(\?user_code=[A-HJ-KM-NP-Z2-9]{8})?$/;
 const loginRoute = async (fastify, opts) => {
-    fastify.get('/login', { config: { skipAuth: true } }, async (request, reply) => {
+    // Issue #75 — tighter per-route rate limit than the global budget
+    // (brute-force / DoS hardening on the sensitive auth surface). Env-tunable
+    // via RATE_LIMIT_AUTH_MAX / RATE_LIMIT_AUTH_TIME_WINDOW.
+    fastify.get('/login', {
+        config: {
+            skipAuth: true,
+            rateLimit: {
+                max: config.RATE_LIMIT_AUTH_MAX,
+                timeWindow: config.RATE_LIMIT_AUTH_TIME_WINDOW,
+            },
+        },
+    }, async (request, reply) => {
         // Already signed in — short-circuit to /me (the documented home
         // page for authenticated users). Skip the IdP roundtrip entirely.
         if (request.session.get('user')) {

package/dist/api/server.js

@@ -57,6 +57,14 @@ export async function createServer(options) {
     const app = await createApp(options?.dbPath);
     // Create Fastify instance with logger
     const server = Fastify({
+        // Issue #75 — proxy-aware client identity. `trustProxy` makes
+        // `request.ip` resolve from `X-Forwarded-For` (consistent with the
+        // device-flow origin trust in §3a). DEFAULT OFF (config.TRUST_PROXY ===
+        // false) so a spoofed X-Forwarded-For cannot move a client's rate-limit
+        // bucket on the loopback-bind default; operators behind a reverse proxy
+        // opt in via TRUST_PROXY. Accepts boolean | number (hop count) | string[]
+        // (IP/CIDR allowlist) — see src/config/env.ts.
+        trustProxy: config.TRUST_PROXY,
         // Timeout configurations to prevent hung requests
         connectionTimeout: config.CONNECTION_TIMEOUT, // Socket inactivity timeout (2 min)
         requestTimeout: config.REQUEST_TIMEOUT, // Maximum time for entire request (1 min)
@@ -246,9 +254,30 @@ export async function createServer(options) {
         // avoid disrupting the existing test suite, which exercises many
         // server.inject calls from 127.0.0.1; operators tune via env.
         await server.register(rateLimit, {
-            max: Number(process.env['RATE_LIMIT_MAX'] ?? 1000),
-            timeWindow: process.env['RATE_LIMIT_TIME_WINDOW'] ?? '1 minute',
+            // Issue #75 — global budget now sourced from the validated config
+            // (src/config/env.ts), not raw process.env. Defaults reproduce the
+            // prior effective behavior exactly: 1000 requests / 1 minute.
+            max: config.RATE_LIMIT_MAX,
+            timeWindow: config.RATE_LIMIT_TIME_WINDOW,
             allowList: (req) => req.url === '/health' || req.url.startsWith('/health/'),
+            // Issue #75 — proxy-aware keying. Prefer the authenticated principal
+            // (PAT token id, else user id) so a single proxy IP does not collapse
+            // every authenticated client into one bucket; fall back to
+            // `request.ip`, which Fastify resolves from X-Forwarded-For ONLY when
+            // `trustProxy` is set (default OFF). The KEY GUARANTEE: with trustProxy
+            // OFF a spoofed X-Forwarded-For cannot change `request.ip`, so it
+            // cannot move the bucket. The rate-limit plugin is registered above the
+            // auth scope, so `request.tokenId` / `request.user` may be undefined on
+            // routes outside that scope — guard both.
+            keyGenerator: (req) => {
+                const tokenId = req.tokenId;
+                if (typeof tokenId === 'number')
+                    return `tok:${tokenId}`;
+                const user = req.user;
+                if (user && typeof user.id === 'number')
+                    return `usr:${user.id}`;
+                return `ip:${req.ip}`;
+            },
             // The error returned here is thrown by @fastify/rate-limit; the project's
             // custom errorHandler reads `statusCode` and `code` to shape the JSON
             // response. We attach both so the response surfaces as
@@ -431,6 +460,9 @@ export async function createServer(options) {
                 await scope.register(deviceCodeRoute, {
                     origin,
                     expectedClientId: deviceClientId,
+                    // Issue #68 (finding 2) — optional operator allowlist pinning which
+                    // hostnames the per-request verification origin may be derived from.
+                    trustedHosts: config.DEVICE_FLOW_TRUSTED_HOSTS,
                 });
                 await scope.register(deviceTokenRoute, { expectedClientId: deviceClientId });
                 await scope.register(deviceHtmlRoute, { origin });

package/dist/cli/auth/browser-open.js

@@ -20,7 +20,12 @@
  */
 import { spawn } from 'node:child_process';
 /**
- * WR-03 (Phase 30 review) — validate the URL shape BEFORE handing it to
+ * WR-03 (Phase 30 review) — STATUS: MITIGATED. This function IS the active
+ * mitigation; `openBrowser` calls it before any spawn. The injection shape
+ * described below is historical context explaining WHY the gate exists, not an
+ * open vulnerability.
+ *
+ * Validate the URL shape BEFORE handing it to
  * a child process. The Windows leg invokes `cmd.exe /c start "" <url>`;
  * even with `shell: false`, libuv's WinAPI quoting of the args array can
  * be perturbed by a URL containing embedded double quotes or trailing
@@ -69,9 +74,17 @@ function isSafeBrowserUrl(url) {
     return true;
 }
 export function openBrowser(url) {
-    // WR-03 (Phase 30 review) — validate the URL BEFORE selecting the
-    // platform spawn args. A malformed/suspicious URL → false so the caller
-    // falls back to printing the URL for the user to paste manually.
+    // WR-03 (Phase 30 review) — ACTIVE injection gate. Validate the URL BEFORE
+    // selecting the platform spawn args, so EVERY platform branch below (incl.
+    // the Windows `cmd /c start` path) only ever receives an http(s) URL that
+    // round-trips through the URL parser unchanged. A malformed/suspicious URL →
+    // false here, before any spawn, so the caller falls back to printing the URL
+    // for the user to paste manually.
+    //
+    // NOTE for reviewers: the historical `verification_uri_complete` cmd-injection
+    // shape described in isSafeBrowserUrl's doc block is MITIGATED by this gate —
+    // it is documented for context, not an open hole. See the regression test
+    // `__tests__/browser-open.test.ts` ("Windows cmd-injection attempt").
     if (!isSafeBrowserUrl(url)) {
         return false;
     }
@@ -83,6 +96,10 @@ export function openBrowser(url) {
             args = [url];
             break;
         case 'win32':
+            // SAFE: `url` already passed the WR-03 isSafeBrowserUrl gate above, so it
+            // is a parser-canonical http(s) URL with no embedded quotes/backslashes
+            // that could escape libuv's WinAPI arg quoting — `cmd /c start` cannot be
+            // tricked into running metacharacters here. (We still pass shell:false.)
             // The empty `""` is the title argument for `cmd /c start` — without it,
             // `start` interprets the first quoted arg as the window title and never
             // opens the URL.

package/dist/config/env.d.ts

@@ -75,11 +75,18 @@ export declare const configSchema: z.ZodObject<{
     SSE_MAX_CONNECTIONS_PER_KEY: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<number, string>>;
     SSE_MAX_CONNECTIONS_PER_IP: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<number, string>>;
     SSE_MAX_CONNECTIONS: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<number, string>>;
+    RATE_LIMIT_MAX: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<number, string>>;
+    RATE_LIMIT_TIME_WINDOW: z.ZodDefault<z.ZodString>;
+    RATE_LIMIT_AUTH_MAX: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<number, string>>;
+    RATE_LIMIT_AUTH_TIME_WINDOW: z.ZodDefault<z.ZodString>;
+    RATE_LIMIT_DEVICE_TOKEN_MAX: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<number, string>>;
+    TRUST_PROXY: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<number | boolean | string[], string | undefined>>;
     OIDC_ISSUER_URL: z.ZodOptional<z.ZodString>;
     OIDC_CLIENT_ID: z.ZodOptional<z.ZodString>;
     OIDC_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
     OIDC_REDIRECT_URI: z.ZodOptional<z.ZodString>;
     OIDC_DEVICE_CLIENT_ID: z.ZodDefault<z.ZodString>;
+    DEVICE_FLOW_TRUSTED_HOSTS: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>;
     OIDC_POST_LOGOUT_REDIRECT_URI: z.ZodOptional<z.ZodString>;
     OIDC_SCOPES: z.ZodDefault<z.ZodString>;
     OIDC_DISCOVERY_MAX_ATTEMPTS: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<number, string>>;

package/dist/config/env.js

@@ -100,6 +100,49 @@ export const configSchema = z
     SSE_MAX_CONNECTIONS_PER_KEY: z.string().min(1).default('4').transform(Number),
     SSE_MAX_CONNECTIONS_PER_IP: z.string().min(1).default('8').transform(Number),
     SSE_MAX_CONNECTIONS: z.string().min(1).default('200').transform(Number),
+    // Issue #75 — global + per-route rate-limit budgets. RATE_LIMIT_MAX /
+    // RATE_LIMIT_TIME_WINDOW back the global @fastify/rate-limit registration
+    // (moved here from raw process.env reads in server.ts). Defaults reproduce
+    // the prior effective behavior exactly: 1000 requests / 1 minute, no proxy
+    // trust. The AUTH_* / DEVICE_TOKEN_* knobs tighten the five sensitive
+    // auth/device routes below the global budget (per-route config.rateLimit).
+    RATE_LIMIT_MAX: z.string().min(1).default('1000').transform(Number),
+    RATE_LIMIT_TIME_WINDOW: z.string().min(1).default('1 minute'),
+    // Tighter budget for the sensitive auth/device routes (login, callback,
+    // device/code, device/verify). Brute-force + DoS hardening.
+    RATE_LIMIT_AUTH_MAX: z.string().min(1).default('10').transform(Number),
+    RATE_LIMIT_AUTH_TIME_WINDOW: z.string().min(1).default('1 minute'),
+    // device/token is polled by the CLI every `interval` seconds, so it gets
+    // a looser budget than the other auth routes (still well below global).
+    RATE_LIMIT_DEVICE_TOKEN_MAX: z.string().min(1).default('30').transform(Number),
+    // Issue #75 — proxy-aware client identity for rate limiting. Controls
+    // Fastify's `trustProxy` factory option, which is what makes
+    // `request.ip` resolve from `X-Forwarded-For`. DEFAULT OFF (false) so the
+    // loopback-bind default never trusts forwarded headers — a spoofed
+    // X-Forwarded-For cannot move a client's rate-limit bucket. Operators
+    // behind a reverse proxy (the documented deployment) opt in. Accepted:
+    //   - unset / 'false'          → false  (do NOT trust forwarded headers)
+    //   - 'true'                   → true   (trust all — proxy is the only hop)
+    //   - integer hop count ('1')  → number (trust N proxy hops)
+    //   - 'ip,cidr,…'              → string[] (trust only these proxy IPs/CIDRs)
+    TRUST_PROXY: z
+        .string()
+        .optional()
+        .transform((raw) => {
+        const s = (raw ?? '').trim();
+        if (s === '' || s.toLowerCase() === 'false')
+            return false;
+        if (s.toLowerCase() === 'true')
+            return true;
+        // Pure integer → hop count. (Reject negatives/decimals → fall through.)
+        if (/^\d+$/.test(s))
+            return Number(s);
+        // Otherwise treat as a comma-separated IP/CIDR allowlist.
+        return s
+            .split(',')
+            .map((p) => p.trim())
+            .filter((p) => p.length > 0);
+    }),
     // Phase 29: OIDC browser flow + session cookie configuration.
     // All four OIDC_* vars are all-or-nothing (see refine below). When unset,
     // OIDC routes return 501 and the session strategy returns null — PAT +
@@ -118,6 +161,26 @@ export const configSchema = z
     // on any server backed by a real IdP. Defaulted so it works with the
     // stock CLI and is NOT part of the all-or-nothing OIDC group.
     OIDC_DEVICE_CLIENT_ID: z.string().min(1).default('wft-cli'),
+    // Issue #68 (finding 2) — optional allowlist of hostnames the device-flow
+    // verification origin may be built from. The `verification_uri` the CLI
+    // prints is derived per-request from the `Host` / `X-Forwarded-Host` header
+    // (see resolveVerificationOrigin) so a LAN/remote client gets a routable
+    // URL instead of `localhost`. That is not a host-header-INJECTION vector
+    // (the URL is returned only to the requesting client), but an operator who
+    // wants to pin the trust boundary can set this to a comma-separated list of
+    // hostnames (`host` or `host:port` accepted; the port is ignored in the
+    // match). When set, a request whose Host is NOT in the list falls back to
+    // the configured origin instead of being echoed. When UNSET (default),
+    // behavior is unchanged — every Host is honored (backward compatible).
+    DEVICE_FLOW_TRUSTED_HOSTS: z
+        .string()
+        .optional()
+        .transform((s) => (s ?? '')
+        .split(',')
+        .map((h) => h.trim().toLowerCase())
+        // Normalize `host:port` → `host`; the allowlist matches on hostname.
+        .map((h) => (h.includes(':') ? (h.split(':')[0] ?? h) : h))
+        .filter((h) => h.length > 0)),
     // WR-03 fix — `post_logout_redirect_uri` for RP-initiated logout.
     // Optional: when absent, the wiring at src/api/server.ts derives a
     // default from OIDC_REDIRECT_URI's origin (+ `/auth/login`). Sourcing

package/dist/skills/tasks/loop-shared.md

@@ -696,6 +696,14 @@ For MCP tools **NEWLY ADDED during this run**, exercise them through the **remot
 
 ### (2b) Artifact-level distributable smoke — the SHIPPED artifact, exercised from OUTSIDE the repo
 
+> ⚠️ **Trusted-operator / trusted-repo operation.** The smoke below packs the
+> repo (`npm pack`), installs the tarball into a temp prefix
+> (`npm i -g --prefix …`), and **executes the shipped binary**. These steps
+> mutate global state and run repo-authored code. Run them ONLY against a
+> checkout you trust and operate. A static-trust or security review of an
+> **untrusted** checkout must **read, not run**, this section — never pack,
+> install, or execute the artifact while evaluating an unknown repo.
+
 **Why this exists (load-bearing).** Per-task verifiers grade against the SOURCE tree, so a capability can be 100% PASS-verified in-repo while the **shipped artifact** (the packed tarball / globally-installed bin) is broken — e.g. an asset resolved from a path that exists in source but is not in the published `files`, a postinstall that references an unshipped file, or a CLI option dropped by a framework bug. These failures are cwd- and packaging-sensitive: they pass in-repo and fail only once installed and run from elsewhere. This smoke closes that gap by exercising the real artifact from a cwd OUTSIDE the repo.
 
 **Trigger (unconditional when the repo ships a distributable).** This smoke runs whenever the target repo ships a distributable — it is NOT gated on a particular task having existed in the run. Detect a distributable generically from `package.json`: it declares a `bin` and/or a `files` allow-list and/or a `prepublishOnly` script, OR it defines a `smoke:global`-style global-install smoke script. If none of these signals is present, the repo ships no distributable and this audit is N/A (skip, not RED).

package/dist/skills/tasks/update.md

@@ -6,6 +6,14 @@ disable-model-invocation: false
 
 # Update Wood Fired Tasks
 
+> ⚠️ **Trusted-operator / trusted-repo operation.** This skill runs
+> `tasks self-update`, which shells out to a global npm install
+> (`npm i -g wood-fired-tasks@latest`) and mutates the host's globally
+> installed CLI. Run it ONLY against a checkout you trust and operate. A
+> static-trust or security review of an **untrusted** checkout must **read,
+> not run**, this flow — never execute self-update, install, or package
+> flows while evaluating an unknown repo.
+
 Updates the installed `tasks` CLI to the latest published version by running the
 built-in `tasks self-update` command. This is the action target of the
 status-line update notification (`⬆ /tasks:update`).

package/dist/slack/commands/tasks-command.js

@@ -1,6 +1,7 @@
 import { NotFoundError, ValidationError, BusinessError } from '../../services/errors.js';
 import { formatTaskList, formatTaskDetail } from '../task-formatter.js';
 import { formatProjectList, formatProjectDetail } from '../formatters/project-formatter.js';
+import { escapeSlackMrkdwn } from '../mrkdwn.js';
 import { ALLOWED_EVENT_TYPES, isAllowedEventType } from '../../events/types.js';
 /**
  * Hard cap on subscription rows (project_id x event_type) per Slack channel.
@@ -243,7 +244,10 @@ async function handleShow(respond, services, args) {
         for (const comment of displayComments) {
             allBlocks.push({
                 type: 'section',
-                text: { type: 'mrkdwn', text: `*${comment.author}*: ${comment.content}` },
+                text: {
+                    type: 'mrkdwn',
+                    text: `*${escapeSlackMrkdwn(comment.author)}*: ${escapeSlackMrkdwn(comment.content)}`,
+                },
             });
         }
         if (comments.length > 5) {
@@ -302,7 +306,7 @@ async function handleCreate(respond, services, identityCache, command, args, sla
         description: flags['description'] || null,
     });
     const blocks = formatTaskDetail(task);
-    await respondBlocks(respond, blocks, `Task created: ${task.title}`);
+    await respondBlocks(respond, blocks, `Task created: ${escapeSlackMrkdwn(task.title)}`);
 }
 /**
  * handleUpdate — /tasks update <id> [--status <s>] [--title <t>] [--priority <p>] [--assignee <a>] [--due <d>] [--description <d>]
@@ -443,7 +447,7 @@ async function handleProjectCreate(respond, services, args) {
         description: flags['description'] || null,
     });
     const blocks = formatProjectDetail(project);
-    await respondBlocks(respond, blocks, `Project created: ${project.name}`);
+    await respondBlocks(respond, blocks, `Project created: ${escapeSlackMrkdwn(project.name)}`);
 }
 /**
  * handleProjectUpdate — /tasks project-update <id> [--name <name>] [--description <desc>]
@@ -612,7 +616,7 @@ async function handleCommentList(respond, services, args) {
             type: 'section',
             text: {
                 type: 'mrkdwn',
-                text: `*${comment.author}* (${comment.created_at})\n${comment.content}`,
+                text: `*${escapeSlackMrkdwn(comment.author)}* (${comment.created_at})\n${escapeSlackMrkdwn(comment.content)}`,
             },
         });
     }
@@ -673,7 +677,7 @@ async function handleSubtaskCreate(respond, services, identityCache, command, ar
         created_by_user_id: actorUserId,
     });
     const blocks = formatTaskDetail(task);
-    await respondBlocks(respond, blocks, `Subtask created: ${task.title}`);
+    await respondBlocks(respond, blocks, `Subtask created: ${escapeSlackMrkdwn(task.title)}`);
 }
 /**
  * handleSubtaskList — /tasks subtask-list <parent_id>
@@ -798,10 +802,10 @@ async function handleSubscribe(respond, services, subscriptionRepo, command, arg
             type: 'section',
             text: {
                 type: 'mrkdwn',
-                text: `:bell: Subscribed this channel to *${project.name}* events: ${eventTypes.map((e) => '`' + e + '`').join(', ')}`,
+                text: `:bell: Subscribed this channel to *${escapeSlackMrkdwn(project.name)}* events: ${eventTypes.map((e) => '`' + e + '`').join(', ')}`,
             },
         },
-    ], `Subscribed to ${project.name} events`);
+    ], `Subscribed to ${escapeSlackMrkdwn(project.name)} events`);
 }
 /**
  * handleUnsubscribe — /tasks unsubscribe [--project <id>]

package/dist/slack/formatters/project-formatter.js

@@ -1,3 +1,4 @@
+import { escapeSlackMrkdwn } from '../mrkdwn.js';
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -38,13 +39,13 @@ export function formatProjectList(projects) {
         if (project === undefined)
             continue;
         const descPreview = project.description
-            ? truncate(project.description, 100)
+            ? escapeSlackMrkdwn(truncate(project.description, 100))
             : '_no description_';
         const section = {
             type: 'section',
             text: {
                 type: 'mrkdwn',
-                text: `*#${project.id} ${project.name}*\n${descPreview}`,
+                text: `*#${project.id} ${escapeSlackMrkdwn(project.name)}*\n${descPreview}`,
             },
         };
         blocks.push(section);
@@ -73,11 +74,13 @@ export function formatProjectDetail(project) {
         type: 'header',
         text: {
             type: 'plain_text',
-            text: nameText,
+            text: escapeSlackMrkdwn(nameText),
             emoji: true,
         },
     };
-    const descText = project.description ? truncate(project.description, 200) : '_none_';
+    const descText = project.description
+        ? escapeSlackMrkdwn(truncate(project.description, 200))
+        : '_none_';
     const fieldsSection = {
         type: 'section',
         fields: [

package/dist/slack/mrkdwn.d.ts

@@ -0,0 +1 @@
+export declare function escapeSlackMrkdwn(value: unknown): string;