Boundaries that were supposed to hold

The security pass. Six findings, none reachable by visiting the site and
every one a boundary this codebase says it keeps.

A subagent is pinned to a list of read-only commands, in every mode,
unattended, with no card anybody could approve -- and `find *` was on it.
find writes files with -fprintf, runs programs with -exec and removes them
with -delete, and none of that needs a character the metacharacter guard
refuses. A page the model had just read could ask for a helper and get a
key into authorized_keys, from Plan mode, which promises to change
nothing. Refused in `subject()` rather than trimmed from the list: a
pattern cannot say "and no dangerous flags", and "this one looks
read-only" is exactly what put find there.

The loopback guard missed `0.0.0.0`, which is not is_loopback but does
connect to localhost -- so it answered a *decided* False and skipped the
DNS half too. The one spelling of "this machine" that walked past a guard
whose whole job is that sentence.

Twice in the update helper, which is the one place this deliberately
crosses a privilege boundary: root ran a script the service account owns,
and root sourced a file that account can replace. Either turns a
compromise of the web application into root. The first needed no
compromise at all -- a pull happens as the service user and root runs
whatever it fetched, so control of the branch was control of root. The
old test asserted that exact ExecStart line and had pinned it in place.

Push endpoints skipped check_url, the only outbound request that did. And
a chat could be filed in another account's folder, which hands over its
system prompt -- `_new_chat` resolved the folder, discarded it when it was
not the caller's, and stored the raw id anyway.

An existing helper install keeps the old wiring until install.sh is
re-run; update.sh now says so when it finds itself inside the checkout.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -16,6 +16,42 @@ for 1.0.0 have something to be assembled from.
 
 ## Unreleased
 
+## 0.9.12
+
+**The security pass.** Six findings, all fixed. None is reachable by simply
+visiting the site; every one of them is a boundary that was supposed to hold
+and did not.
+
+- Fixed: **a helper could write files and run programs on the remote machine,
+  unattended, in a mode that promises to change nothing.** A subagent is pinned
+  to a fixed list of read-only commands — and `find` was on it. `find -fprintf`
+  writes a file, `find -exec` runs a program, `find -delete` removes one, and
+  none of them needs a character the shell-metacharacter guard refuses. A page
+  the model had just read could have asked for a helper and got an SSH key
+  written into `authorized_keys`. Those flags are refused outright now, whatever
+  list a command is on.
+- Fixed: **an SSH connection could be pointed at `0.0.0.0` and reach the machine
+  LLeMbas runs on**, with the "may a connection point here" setting still
+  reading *off*. Every other spelling was caught; that one is neither a real
+  destination nor a refused one, and connecting to it goes to localhost.
+- Fixed, twice, in the update helper — the one place this deliberately crosses a
+  privilege boundary: **root ran a script the unprivileged service account
+  owns**, and **root sourced a file that account can replace**. Either turns a
+  compromise of the web application into root on the host, which is exactly what
+  the unprivileged split exists to prevent. The first also meant control of the
+  branch was control of root, with no compromise needed at all.
+  **If you installed the update helper before this, re-run the installer** —
+  the old wiring stays until you do, and the update script now says so loudly
+  when it notices.
+- Fixed: **browser notification endpoints skipped the guard that stops the
+  server being aimed at your own network.** It was the only outbound request in
+  the codebase not going through it.
+- Fixed: **a chat could be put in another account's folder**, and a folder hands
+  its system prompt to the chats inside it — so that read a setting across an
+  ownership boundary through a field that looks like a tag.
+- Fixed: a `"` typed into the share panel's search box silently stopped every
+  checkbox in the panel from doing anything.
+
 ## 0.9.11
 
 - The Updates page no longer runs the **Check the remote** button flush against