fix(auth): reject spoofed Tailscale identity on management ingress

.github/workflows/release.yml

@@ -67,6 +67,14 @@ jobs:
   bump-dev-version:
     needs: publish
     if: ${{ inputs.dry-run != true }}
+    # A reusable-workflow CALL cannot grant the callee more than the calling job holds,
+    # and GitHub refuses the whole run at startup when the called workflow's own job
+    # declares permissions the caller did not pass down ("startup_failure", runs
+    # 33615174183 / 33615177849 — the first dispatches since #3129 wired this call).
+    # The callee's job declares exactly these two; nothing else in this file gains them.
+    permissions:
+      contents: write
+      pull-requests: write
     uses: ./.github/workflows/dev-version-bump.yml
     with:
       released-version: v${{ inputs.version }}

docs-site/src/content/docs/fr/guides/remote-hub.md

@@ -17,7 +17,7 @@ ocx sync
 
 La clé client est écrite dans le fichier privé `service-api-token`, jamais dans `config.json`. En mode connecté, l’usage provient du hub et est filtré par `apiKeyId`; après déconnexion, il provient du stockage local. Il n’existe aucune réplication entre les deux.
 
-Le jeton admin permet la gestion ordinaire mais ne peut jamais créer une session de consentement. Les actions de consentement exigent une `gui-session`, une Origin correspondante et un jeton CSRF. `Tailscale-User-Login` n’est fiable que sur l’entrée de gestion dédiée; renseignez les identités exactes dans `remoteGui.allowedTailscaleUsers`.
+Le jeton admin permet la gestion ordinaire mais ne peut jamais créer une session de consentement. Les actions de consentement exigent une `gui-session`, une Origin correspondante et un jeton CSRF. L’entrée TCP loopback ne fait pas confiance à `Tailscale-User-Login`; les sessions distantes utilisent l’association à usage unique.
 
 ## Service et Tailscale Serve
 
@@ -27,7 +27,6 @@ ocx config set hostname 100.64.0.10
 ocx config set hub.managementPublicOrigin '"https://hub-name.tailnet-name.ts.net"'
 ocx config set corsAllowOrigins '["http://localhost:10100"]'
 ocx config set hub.managementIngress '{"enabled":true,"port":10101}'
-ocx config set remoteGui.allowedTailscaleUsers '["operator@example.com"]'
 export OPENCODEX_API_AUTH_TOKEN="$(openssl rand -hex 32)"
 ocx service install
 ```

docs-site/src/content/docs/guides/remote-hub.md

@@ -21,9 +21,9 @@ public-internet surface and is outside this deployment model.
 - A raw management admin token can perform ordinary administration, but it cannot mint a browser
   session or authorize consent-bearing actions such as starring the repository. Those actions
   require a server-issued `gui-session`, matching browser origin, and CSRF token.
-- `Tailscale-User-Login` is trusted only on the separately bound management ingress. The same header
-  on the public listener is ignored. `remoteGui.allowedTailscaleUsers` controls session issuance; it
-  does not create a new general-purpose principal.
+- `Tailscale-User-Login` is not trusted on the loopback TCP management ingress. Any local process can
+  connect to that socket and forge proxy headers, so remote browser sessions use the one-use pairing
+  flow instead.
 
 ## Roles and direct data flow
 
@@ -77,7 +77,6 @@ ocx config set hostname 100.64.0.10
 ocx config set hub.managementPublicOrigin '"https://hub-name.tailnet-name.ts.net"'
 ocx config set corsAllowOrigins '["http://localhost:10100"]'
 ocx config set hub.managementIngress '{"enabled":true,"port":10101}'
-ocx config set remoteGui.allowedTailscaleUsers '["operator@example.com"]'
 
 # Generate/read this in a protected operator shell or secret manager.
 # It is a data-admission token, not a provider credential.
@@ -113,9 +112,9 @@ tailscale serve --bg --https=443 http://127.0.0.1:10101
 tailscale serve status
 ```
 
-Set `hub.managementPublicOrigin` to the exact HTTPS origin shown by Serve. Add the operator's exact
-Tailscale login to `remoteGui.allowedTailscaleUsers`; an empty list means no remote identity can mint
-a session. Verify both directions:
+Set `hub.managementPublicOrigin` to the exact HTTPS origin shown by Serve. The loopback backend does
+not accept Tailscale identity headers as authentication; establish the browser session with the
+single-use pairing flow. Verify both directions:
 
 ```bash
 # Negative: the loopback-only port must not be reachable through the node's tailnet address.
@@ -125,9 +124,8 @@ curl --fail --connect-timeout 3 http://100.64.0.10:10101/ && echo "unexpected ex
 curl --fail --silent --show-error https://hub-name.tailnet-name.ts.net/ >/dev/null
 ```
 
-The positive browser test must use a real signed-in Tailscale session; a bare `curl` may not carry the
-identity headers needed for automatic session issuance. Pairing remains the fallback when the HTTPS
-frontend cannot provide trustworthy Tailscale identity.
+The positive browser test verifies transport reachability only. Complete the one-use pairing flow to
+create a remote browser session.
 
 ### Operator-owned ts.net certificate proxy
 
@@ -231,7 +229,6 @@ docker compose run --rm hub bun run src/cli/index.ts config set runtimeRole hub
 docker compose run --rm hub bun run src/cli/index.ts config set hostname 0.0.0.0
 docker compose run --rm hub bun run src/cli/index.ts config set hub.managementPublicOrigin '"https://hub-name.tailnet-name.ts.net"'
 docker compose run --rm hub bun run src/cli/index.ts config set hub.managementIngress '{"enabled":true,"port":10101}'
-docker compose run --rm hub bun run src/cli/index.ts config set remoteGui.allowedTailscaleUsers '["operator@example.com"]'
 docker compose up -d
 ```
 

docs-site/src/content/docs/ja/guides/remote-hub.md

@@ -17,7 +17,7 @@ ocx sync
 
 発行されたキーは所有者だけが読める `service-api-token` に保存され、`config.json` には入りません。接続中の使用量は hub 側で同じ `apiKeyId` に絞り込まれ、切断後はローカル保存分を表示します。両者はミラーリングされません。
 
-管理トークンは通常の管理だけに使え、同意セッションを作ることは永久にできません。同意操作にはサーバー発行の `gui-session`、一致する Origin、CSRF が必要です。`Tailscale-User-Login` は専用管理リスナーでのみ信頼し、許可する ID を `remoteGui.allowedTailscaleUsers` に正確に設定します。
+管理トークンは通常の管理だけに使え、同意セッションを作ることは永久にできません。同意操作にはサーバー発行の `gui-session`、一致する Origin、CSRF が必要です。Loopback TCP 管理入口は `Tailscale-User-Login` を信頼せず、リモートブラウザーセッションには一度限りのペアリングを使います。
 
 ## サービスと Tailscale Serve
 
@@ -27,7 +27,6 @@ ocx config set hostname 100.64.0.10
 ocx config set hub.managementPublicOrigin '"https://hub-name.tailnet-name.ts.net"'
 ocx config set corsAllowOrigins '["http://localhost:10100"]'
 ocx config set hub.managementIngress '{"enabled":true,"port":10101}'
-ocx config set remoteGui.allowedTailscaleUsers '["operator@example.com"]'
 export OPENCODEX_API_AUTH_TOKEN="$(openssl rand -hex 32)"
 ocx service install
 ```

docs-site/src/content/docs/ko/guides/remote-hub.md

@@ -28,7 +28,7 @@ ocx sync
 - 프로바이더/OAuth 인증 정보는 허브 밖으로 복사하지 마세요.
 - 데이터 키는 `service-api-token` 또는 `OCX_API_TOKEN_FILE`로 전달하며 관리 권한이 없습니다.
 - 관리자 토큰은 일반 관리 작업만 할 수 있습니다. 브라우저 동의 세션을 만들거나 저장소 Star 같은 동의 작업을 승인할 수는 없습니다. 그런 작업에는 서버가 발급한 `gui-session`, 일치하는 Origin, CSRF 토큰이 필요합니다.
-- `Tailscale-User-Login`은 별도 관리 리스너에서만 신뢰합니다. 공개 리스너의 같은 헤더는 무시합니다. `remoteGui.allowedTailscaleUsers`에는 허용할 로그인 ID를 정확히 적으세요.
+- 루프백 TCP 관리 리스너는 `Tailscale-User-Login`을 신뢰하지 않습니다. 원격 브라우저 세션은 일회용 pairing으로 생성합니다.
 
 ## systemd 또는 launchd
 
@@ -38,7 +38,6 @@ ocx config set hostname 100.64.0.10
 ocx config set hub.managementPublicOrigin '"https://hub-name.tailnet-name.ts.net"'
 ocx config set corsAllowOrigins '["http://localhost:10100"]'
 ocx config set hub.managementIngress '{"enabled":true,"port":10101}'
-ocx config set remoteGui.allowedTailscaleUsers '["operator@example.com"]'
 export OPENCODEX_API_AUTH_TOKEN="$(openssl rand -hex 32)"
 ocx service install
 ocx service status

docs-site/src/content/docs/reference/configuration/server.md

@@ -275,10 +275,8 @@ intended account and workload.
 | --- | --- | --- | --- |
 | `hub.managementPublicOrigin` | string | unset | The canonical browser-reachable management origin a hub advertises, for example the HTTPS origin Tailscale Serve prints. It is what `/readyz` reports as `managementUrl` while `runtimeRole` is `hub`; with it unset the hub falls back to whatever origin each request arrived on, so a client behind a different frontend can be handed an address it cannot reach. |
 | `hub.managementIngress` | `{enabled:false}` or `{enabled:true, port}` | `{enabled:false}` | An extra management-only listener for a local HTTPS frontend. The hostname is not configurable: when enabled the socket always binds `127.0.0.1`, and only GUI, session-bootstrap, and management API routes are admitted. Data-plane routes are rejected before dispatch. |
-| `remoteGui.allowedTailscaleUsers` | string[] | `[]` (empty — nobody) | Exact Tailscale login identities allowed to be issued an automatic remote GUI session. The `Tailscale-User-Login` header is trusted **only** on the separate management ingress; an empty list means no remote identity can mint a session, which is the safe default rather than an oversight. Identities are compared exactly, so a typo silently denies access. |
+| `remoteGui.allowedTailscaleUsers` | string[] | `[]` | Retained for configuration compatibility. The loopback TCP management ingress does not trust `Tailscale-User-Login`, because local callers can forge proxy headers; remote browser sessions use one-use pairing instead. |
 | `remoteGui.allowInsecureHttp` | boolean | unset | **Retired — has no effect.** It once permitted a one-time pairing exchange over non-loopback plaintext HTTP. A pairing grant now crosses loopback or authenticated HTTPS only. The key is still parsed so an existing `config.json` keeps loading (the schema is strict, and dropping the key outright would make an older config fail to load entirely); a persisted `true` is reported once and then ignored. Remove it from your config. |
 
-A hub that is reachable from a browser needs `hub.managementPublicOrigin` and at least one entry
-in `remoteGui.allowedTailscaleUsers`. Setting the origin without the user list produces a hub that
-advertises itself correctly and then refuses every session; setting the user list without the
-origin produces sessions pointed at whichever origin the request happened to use.
+A hub that is reachable from a browser needs `hub.managementPublicOrigin`; remote browser sessions
+are established through the one-use pairing flow.

docs-site/src/content/docs/ru/guides/remote-hub.md

@@ -17,7 +17,7 @@ ocx sync
 
 Ключ клиента записывается в защищённый `service-api-token`, а не в `config.json`. При подключении статистика читается с hub и фильтруется по `apiKeyId`; после отключения используется локальное хранилище. Зеркалирования нет.
 
-Admin token разрешает обычное управление, но никогда не создаёт consent session. Для действий с согласием нужны `gui-session`, совпадающий Origin и CSRF. Заголовок `Tailscale-User-Login` доверен только отдельному management ingress; точные логины задаются в `remoteGui.allowedTailscaleUsers`.
+Admin token разрешает обычное управление, но никогда не создаёт consent session. Для действий с согласием нужны `gui-session`, совпадающий Origin и CSRF. Loopback TCP ingress не доверяет `Tailscale-User-Login`; удалённая browser session создаётся через одноразовое pairing.
 
 ## Сервис и Tailscale Serve
 
@@ -27,7 +27,6 @@ ocx config set hostname 100.64.0.10
 ocx config set hub.managementPublicOrigin '"https://hub-name.tailnet-name.ts.net"'
 ocx config set corsAllowOrigins '["http://localhost:10100"]'
 ocx config set hub.managementIngress '{"enabled":true,"port":10101}'
-ocx config set remoteGui.allowedTailscaleUsers '["operator@example.com"]'
 export OPENCODEX_API_AUTH_TOKEN="$(openssl rand -hex 32)"
 ocx service install
 ```

docs-site/src/content/docs/tr/guides/remote-hub.md

@@ -17,7 +17,7 @@ ocx sync
 
 İstemci anahtarı yalnızca sahibinin okuyabildiği `service-api-token` dosyasına yazılır, `config.json` içine yazılmaz. Bağlı kullanım hub deposundan aynı `apiKeyId` ile filtrelenir; bağlantı kesilince yerel depo kullanılır. İki depo birbirini yansıtmaz.
 
-Admin token sıradan yönetim yapabilir ancak hiçbir zaman onay oturumu oluşturamaz. Onay işlemleri sunucu tarafından verilen `gui-session`, eşleşen Origin ve CSRF ister. `Tailscale-User-Login` yalnızca ayrı yönetim girişinde güvenilirdir; tam kimlikleri `remoteGui.allowedTailscaleUsers` içinde belirtin.
+Admin token sıradan yönetim yapabilir ancak hiçbir zaman onay oturumu oluşturamaz. Onay işlemleri sunucu tarafından verilen `gui-session`, eşleşen Origin ve CSRF ister. Loopback TCP girişi `Tailscale-User-Login` başlığına güvenmez; uzak tarayıcı oturumları tek kullanımlık eşleştirme ile oluşturulur.
 
 ## Servis ve Tailscale Serve
 
@@ -27,7 +27,6 @@ ocx config set hostname 100.64.0.10
 ocx config set hub.managementPublicOrigin '"https://hub-name.tailnet-name.ts.net"'
 ocx config set corsAllowOrigins '["http://localhost:10100"]'
 ocx config set hub.managementIngress '{"enabled":true,"port":10101}'
-ocx config set remoteGui.allowedTailscaleUsers '["operator@example.com"]'
 export OPENCODEX_API_AUTH_TOKEN="$(openssl rand -hex 32)"
 ocx service install
 ```

docs-site/src/content/docs/zh-cn/guides/remote-hub.md

@@ -17,7 +17,7 @@ ocx sync
 
 客户端密钥写入仅所有者可读的 `service-api-token`，绝不会写入 `config.json`。连接期间，使用记录来自 hub 并按稳定的 `apiKeyId` 过滤；断开后显示本地记录。两者不会镜像。
 
-Admin token 只能执行普通管理，永远不能创建用户同意会话。用户同意操作必须使用服务器签发的 `gui-session`、匹配的 Origin 和 CSRF。`Tailscale-User-Login` 只在独立管理入口可信；请在 `remoteGui.allowedTailscaleUsers` 中填写准确登录名。
+Admin token 只能执行普通管理，永远不能创建用户同意会话。用户同意操作必须使用服务器签发的 `gui-session`、匹配的 Origin 和 CSRF。Loopback TCP 管理入口不信任 `Tailscale-User-Login`；远程浏览器会话使用一次性配对建立。
 
 ## systemd/launchd 与 Tailscale Serve
 
@@ -27,7 +27,6 @@ ocx config set hostname 100.64.0.10
 ocx config set hub.managementPublicOrigin '"https://hub-name.tailnet-name.ts.net"'
 ocx config set corsAllowOrigins '["http://localhost:10100"]'
 ocx config set hub.managementIngress '{"enabled":true,"port":10101}'
-ocx config set remoteGui.allowedTailscaleUsers '["operator@example.com"]'
 export OPENCODEX_API_AUTH_TOKEN="$(openssl rand -hex 32)"
 ocx service install
 ```

docs-site/src/content/docs/zh-tw/guides/remote-hub.md

@@ -17,7 +17,7 @@ ocx sync
 
 用戶端金鑰會寫入只有擁有者可讀的 `service-api-token`，絕不寫入 `config.json`。連線期間，用量來自 hub 並依穩定的 `apiKeyId` 篩選；中斷後則顯示本機記錄。兩者不會互相鏡像。
 
-Admin token 只能執行一般管理，永遠不能建立使用者同意工作階段。同意操作必須使用伺服器簽發的 `gui-session`、相符的 Origin 與 CSRF。`Tailscale-User-Login` 只在獨立管理入口可信；請在 `remoteGui.allowedTailscaleUsers` 填入完整且正確的登入名稱。
+Admin token 只能執行一般管理，永遠不能建立使用者同意工作階段。同意操作必須使用伺服器簽發的 `gui-session`、相符的 Origin 與 CSRF。Loopback TCP 管理入口不信任 `Tailscale-User-Login`；遠端瀏覽器工作階段使用一次性配對建立。
 
 ## systemd/launchd 與 Tailscale Serve
 
@@ -27,7 +27,6 @@ ocx config set hostname 100.64.0.10
 ocx config set hub.managementPublicOrigin '"https://hub-name.tailnet-name.ts.net"'
 ocx config set corsAllowOrigins '["http://localhost:10100"]'
 ocx config set hub.managementIngress '{"enabled":true,"port":10101}'
-ocx config set remoteGui.allowedTailscaleUsers '["operator@example.com"]'
 export OPENCODEX_API_AUTH_TOKEN="$(openssl rand -hex 32)"
 ocx service install
 ```

src/server/index.ts

@@ -763,7 +763,8 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   const loopbackListener = config.unauthenticatedLoopbackListener;
   const loopbackListenerPort = loopbackListener?.enabled ? loopbackListener.port : null;
   // Hub management ingress is a third, management-only listener. Its address is intentionally
-  // fixed: the kernel loopback bind is the trust boundary that permits Tailscale identity headers.
+  // fixed, but the loopback bind is only an exposure boundary: local processes can connect to it,
+  // so requests on this ordinary TCP socket must not be treated as authenticated proxy traffic.
   const managementIngress = config.runtimeRole === "hub" ? config.hub?.managementIngress : undefined;
   const managementIngressPort = managementIngress?.enabled ? managementIngress.port : null;
 
@@ -1952,7 +1953,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       if (url.pathname === "/opencodex-session") {
         if (req.method === "GET") {
           const session = issueGuiSession(req, config, managementAuth, {
-            trustedTailscaleIngress: ingress === "hub-management",
+            trustedTailscaleIngress: false,
           });
           return session
             ? withManagementCors(serveSessionBootstrap(session), req, config)
@@ -2011,7 +2012,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       }
       const guiSessionCandidate = req.method === "GET" && (url.pathname === "/" || !url.pathname.includes("."))
         ? issueGuiSession(req, config, managementAuth, {
-          trustedTailscaleIngress: ingress === "hub-management",
+          trustedTailscaleIngress: false,
         })
         : null;
       const guiFile = serveGuiFile(

structure/05_gui-and-management-api.md

@@ -66,13 +66,12 @@ surface bound exactly to `127.0.0.1` for a local Tailscale Serve or operator TLS
 listener serves only packaged GUI/SPA routes, `GET`/`POST /opencodex-session`, and `/api/*`; all data,
 health, readiness, WebSocket, and unknown-static routes receive a JSON 404 before dispatch.
 
-Tailscale identity headers authorize session issuance only when the request arrived on that specific
-listener and the exact login appears in `remoteGui.allowedTailscaleUsers`. The public listener and
-the unauthenticated data-loopback listener always pass `trustedTailscaleIngress: false`, regardless
-of `Host`, `Origin`, `Forwarded`, `X-Forwarded-*`, or `Tailscale-User-*` values. A generic TLS proxy
-cannot establish that identity and uses the existing single-use, digest-only, origin-bound pairing
-exchange. Pairing accepts no admin/data credential substitute and consumes a grant only after the
-full origin predicate succeeds.
+The loopback TCP listener is not a proxy-authentication boundary: any local process can connect to
+it and supply `Tailscale-User-*` headers. Runtime listener call sites therefore always pass
+`trustedTailscaleIngress: false`, regardless of listener, `Host`, `Origin`, `Forwarded`, or
+`X-Forwarded-*` values. Remote dashboards use the existing single-use, digest-only, origin-bound
+pairing exchange. Pairing accepts no admin/data credential substitute and consumes a grant only
+after the full origin predicate succeeds.
 
 The server issues a local in-memory session for five minutes or a remote session for twelve hours,
 with 128 live sessions maximum. Every session is bound to the exact server and browser origins;