Boundaries that were supposed to hold

The security pass. Six findings, none reachable by visiting the site and
every one a boundary this codebase says it keeps.

A subagent is pinned to a list of read-only commands, in every mode,
unattended, with no card anybody could approve -- and `find *` was on it.
find writes files with -fprintf, runs programs with -exec and removes them
with -delete, and none of that needs a character the metacharacter guard
refuses. A page the model had just read could ask for a helper and get a
key into authorized_keys, from Plan mode, which promises to change
nothing. Refused in `subject()` rather than trimmed from the list: a
pattern cannot say "and no dangerous flags", and "this one looks
read-only" is exactly what put find there.

The loopback guard missed `0.0.0.0`, which is not is_loopback but does
connect to localhost -- so it answered a *decided* False and skipped the
DNS half too. The one spelling of "this machine" that walked past a guard
whose whole job is that sentence.

Twice in the update helper, which is the one place this deliberately
crosses a privilege boundary: root ran a script the service account owns,
and root sourced a file that account can replace. Either turns a
compromise of the web application into root. The first needed no
compromise at all -- a pull happens as the service user and root runs
whatever it fetched, so control of the branch was control of root. The
old test asserted that exact ExecStart line and had pinned it in place.

Push endpoints skipped check_url, the only outbound request that did. And
a chat could be filed in another account's folder, which hands over its
system prompt -- `_new_chat` resolved the folder, discarded it when it was
not the caller's, and stored the raw id anyway.

An existing helper install keeps the old wiring until install.sh is
re-run; update.sh now says so when it finds itself inside the checkout.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_updates.py

@@ -376,12 +376,86 @@ def test_the_helper_units_take_no_branch_from_the_request():
     assert "__UPDATE_BRANCH__" in unit
     assert "__UPDATE_CHANNEL__" in unit
     assert "update-requested" in unit  # deleted, not read
-    assert "ExecStart=/bin/bash __PREFIX__/app/deploy/update.sh" in unit
     # Deleted before the script runs, or the path unit re-arms on a file that is
     # still there and the update loops.
     assert unit.index("ExecStartPre") < unit.index("ExecStart=")
 
 
+def test_root_does_not_run_a_script_the_service_account_owns():
+    """The unit has no `User=`, so ExecStart is root. It used to be
+    `__PREFIX__/app/deploy/update.sh` -- inside the checkout, owned by the
+    unprivileged service account -- so anything able to write as that account
+    could rewrite it and be root, and so could whoever controlled the branch,
+    since the pull runs as that account and root runs what it fetched.
+
+    **The old test asserted that exact line.** It passed for the whole life of
+    the feature and pinned the vulnerability in place, which is this codebase's
+    recurring failure applied to a privilege boundary: an assertion about the
+    text rather than about the property the text was supposed to have.
+    """
+    from pathlib import Path
+
+    import lembas
+
+    root = Path(lembas.__file__).resolve().parents[2]
+    unit = (root / "deploy/lembas-update.service").read_text()
+    install = (root / "deploy/install.sh").read_text()
+
+    exec_line = next(line for line in unit.splitlines() if line.startswith("ExecStart="))
+    assert "__PREFIX__" not in exec_line, "root would run a file inside the checkout"
+    assert "__UPDATE_HELPER__" in exec_line
+
+    # And the installer puts that copy somewhere root owns.
+    assert 'install -o root -g root -m 755' in install
+    assert "__UPDATE_HELPER__|$UPDATE_HELPER" in install
+
+
+def test_the_root_script_never_sources_a_file_the_service_account_can_replace():
+    """`.deploy-env` is written by the installer with `sudo tee`, so the file is
+    root-owned -- but `$PREFIX` is the service account's own directory at mode
+    755, and write permission on a directory is all it takes to unlink a file
+    and put another there. `.` would have run its contents **as root**, and this
+    script became root-triggerable by anyone who can create one file in
+    `$PREFIX/data`, which is that same account.
+
+    Asserted as "nothing under $PREFIX is sourced" rather than as the shape of
+    one line, because the next thing to be read from there would have the same
+    problem and a test naming `.deploy-env` would not notice.
+    """
+    from pathlib import Path
+
+    import lembas
+
+    root = Path(lembas.__file__).resolve().parents[2]
+    script = (root / "deploy/update.sh").read_text()
+
+    for line in script.splitlines():
+        stripped = line.strip()
+        if stripped.startswith((". ", "source ")):
+            assert "$PREFIX" not in stripped and "$APP" not in stripped, stripped
+
+    # And the two values it does want are extracted by pattern.
+    assert "s/^SITE_HOST=" in script
+    assert "s/^APP_PORT=" in script
+
+
+def test_the_update_script_notices_the_old_wiring():
+    """A host installed before the fix keeps the old unit, and re-running the
+    installer is the only thing that moves it. The script therefore has to say
+    so when it finds itself running from inside the checkout -- otherwise the
+    hosts that are vulnerable are exactly the ones that never hear about it."""
+    from pathlib import Path
+
+    import lembas
+
+    root = Path(lembas.__file__).resolve().parents[2]
+    script = (root / "deploy/update.sh").read_text()
+
+    assert "INSECURE WIRING" in script
+    assert 'readlink -f "$0"' in script
+    assert "INSTALL_UPDATE_HELPER=1" in script
+
+
 def test_the_image_bakes_no_secret_and_no_data():
     from pathlib import Path