fix(api): keep the onboarding scan off the host unless the owner opts in (#98)

* fix(api): keep the onboarding scan off the host unless the owner opts in

The first-run scan walked the home directory of the API process user for
every account that signed up, with no consent, and its status endpoint
accepted any scan id. Any account could read the repository paths and
remotes of the server owner.

The scan now stays simulated unless the deployment configures
ONBOARDING_SCAN_HOME and the requesting account is the deployment owner;
the previous HOME fallback is gone. Scan records remember who started
them and the status endpoint answers only that account.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u

* ci: give each runner on a shared host its own E2E ports

Two Linux runners live on the same host. Every Web E2E job first frees
"stale" listeners on the fixed ports 3110, 3111, 5180 and 4321 with
fuser -k, so a job starting on the second runner killed the Vite server
of the job already running on the first one. The victim died with
SIGKILL (exit 137), and its remaining tests failed on reloads that could
no longer reach a server. This is what made the Web E2E run on this PR
red, and it explains the recurring reload failures on main whenever two
runs overlapped.

The workflow now derives API_PORT, WEB_PORT and WWW_PORT from the runner
name (suffix -N means an offset of N times 100), and the port-freeing
script follows those settings instead of a hard-coded list. The harness,
Vite, the API and the marketing site already read these variables.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
(cherry picked from commit 2f05ab6a817e5198e2a740706976108b7b1edde1)

* test(testkit): cover the env-driven E2E ports instead of a fixed list

The ports test parsed a hard-coded array that no longer exists. It now
runs the script on a fake host whose fuser finds nothing, and checks the
default ports, the per-runner override, the rejection of a non-numeric
setting, and that the workflow picks the ports before freeing them.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
(cherry picked from commit cd0aedafcdec1b24dea924d8924b3b29af29d598)

* ci: keep every runner off the default E2E ports

Branches that still free the fixed ports 3110, 3111, 5180 and 4321 keep
running on the shared host (main, the nightly run, other open PRs) until
they carry the per-runner ports. A job of ours on the runner without a
numeric suffix used exactly those defaults, so such a neighbour could
still kill it, and its own port freeing could kill the neighbour. The
unsuffixed runner now starts at offset 100, so no job from this workflow
touches the defaults in either direction.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
(cherry picked from commit ddf5febdb3072425442ef375ca0be63fbe09e7f1)

* fix(web): recover lazy routes and overlays from a failed module fetch

When the browser aborts a module request while a page loads, the lazy
import rejects and the route throws, leaving a blank page. Chromium does
this whenever a network interface appears or disappears mid-request
(net::ERR_NETWORK_CHANGED), which happens on a laptop that changes
networks and on the CI host every time a container starts or stops. A
Web E2E run hit exactly this: two modules of the onboarding page failed
to load and the suite waited on an empty document.

Lazy routes and overlays now load through a helper that retries the
import once and, when the browser keeps rejecting it from its module
map, reloads the page a single time before surfacing the error.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
(cherry picked from commit d5dacb12f14380071ef14ba8845d18c9d39e3fac)

* fix(web): reload once when the module graph is aborted while booting

The lazy-route recovery cannot help when the browser aborts a module of
the static import graph: nothing of the app runs, the root stays empty,
and the only trace is a console error. A Web E2E run hit this right
after a page reload, when four modules of the shell failed with
net::ERR_NETWORK_CHANGED and the shell never rendered.

An inline script in the HTML entry now listens for the error event of
the module script and reloads the page once, guarded by a session flag
that the entry module clears after a successful boot. The existing
preload recovery stays in place; it only covers Vite's chunk preloads of
production builds.

A new E2E spec aborts one module request during boot and one lazy route
request, and expects the sign-in page to render in both cases.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
(cherry picked from commit e5b7e036e1a60e7e270592c4b9382ee23ed45ccb)

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>

.env.example

@@ -25,6 +25,10 @@ PUBLIC_POSTHOG_KEY=
 PUBLIC_POSTHOG_HOST=https://us.i.posthog.com
 SIGNUPS_ENABLED=true
 SIGNUP_ALLOWLIST=
+# First-run discovery. Leave unset and the onboarding scan never touches the host filesystem.
+# Set a home-style directory (its Projects, Documents, src, ... subfolders are scanned) to let the
+# deployment owner's own onboarding discover local projects. Other accounts never scan the host.
+# ONBOARDING_SCAN_HOME=
 ENCRYPTION_KEY=replace-with-64-random-hex-characters
 DATA_DIR=./data
 SANDBOX_SUPERVISOR_URL=http://127.0.0.1:7091

apps/api/src/app.ts

@@ -476,6 +476,7 @@ export async function createApp(
       defaultModel: env.defaultModel,
       teamChatJudgeProvider: env.teamChatJudgeProvider,
       teamChatJudgeModel: env.teamChatJudgeModel,
+      onboardingScanHome: env.onboardingScanHome,
       deploymentModelKey: env.deploymentModelKey,
       webOrigin: env.webOrigin,
       privacyPolicyUrl: env.privacyPolicyUrl,

apps/api/src/env.test.ts

@@ -35,6 +35,13 @@ describe("loadEnv", () => {
     expect(env.wakeupDriver).toBe("memory");
   });
 
+  it("keeps the onboarding scan off the host unless a scan home is configured", () => {
+    expect(loadEnv(base).onboardingScanHome).toBeUndefined();
+    expect(loadEnv({ ...base, ONBOARDING_SCAN_HOME: " /srv/home " }).onboardingScanHome).toBe(
+      "/srv/home",
+    );
+  });
+
   it("loads a trading bot origin and refuses credentials", () => {
     expect(loadEnv(base).tradingBotUrl).toBeUndefined();
     expect(

apps/api/src/env.ts

@@ -26,6 +26,7 @@ export interface AppEnv {
   apiHost: string;
   signupsEnabled: string | undefined;
   signupAllowlist: string | undefined;
+  onboardingScanHome: string | undefined;
   encryptionKey: string;
   dataDir: string;
   /** Opt-in Pi JSONL session recording under DATA_DIR/pi-sessions. Default off. */
@@ -116,6 +117,7 @@ export function loadEnv(source: NodeJS.ProcessEnv = process.env): AppEnv {
     apiHost: source.API_HOST ?? "127.0.0.1",
     signupsEnabled: source.SIGNUPS_ENABLED,
     signupAllowlist: source.SIGNUP_ALLOWLIST,
+    onboardingScanHome: optional(source.ONBOARDING_SCAN_HOME),
     encryptionKey: resolveEncryptionKey(source),
     dataDir: source.DATA_DIR ?? "./data",
     piSessionRecording: source.PI_SESSION_RECORDING === "true",

apps/api/src/onboarding-scan.test.ts

@@ -0,0 +1,64 @@
+import { mkdir, mkdtemp, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { getScanStatus, startOnboardingScan } from "./onboarding-scan.js";
+
+const owner = { userId: "user-owner", isDeploymentOwner: true };
+const member = { userId: "user-member", isDeploymentOwner: false };
+
+async function scanHomeWithOneFile(): Promise<string> {
+  const home = await mkdtemp(join(tmpdir(), "evoo-scan-"));
+  await mkdir(join(home, "Projects"));
+  await writeFile(join(home, "Projects", "notes.ts"), "export const x = 1;\n");
+  return home;
+}
+
+async function completed(scanId: string, userId: string) {
+  return await vi.waitFor(
+    async () => {
+      const status = await getScanStatus(scanId, userId);
+      if (status.status !== "complete" && status.status !== "failed") throw new Error("pending");
+      return status;
+    },
+    { timeout: 10_000, interval: 50 },
+  );
+}
+
+describe("onboarding scan", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("hides a scan from every account except the one that started it", async () => {
+    const { scanId } = await startOnboardingScan({ actor: member }, {});
+    await expect(getScanStatus(scanId, owner.userId)).rejects.toThrow(/Scan not found/);
+    await expect(getScanStatus(scanId, member.userId)).resolves.toMatchObject({
+      status: expect.any(String),
+    });
+    await expect(getScanStatus("scan_missing", member.userId)).rejects.toThrow(/Scan not found/);
+  });
+
+  it("never reads the host without a configured scan home", async () => {
+    const { scanId } = await startOnboardingScan({ actor: owner }, {});
+    const status = await completed(scanId, owner.userId);
+    expect(status.status).toBe("complete");
+    expect(status.result).toMatchObject({ localRepos: [], fileSummary: { totalFiles: 0 } });
+  });
+
+  it("lets only the deployment owner discover the configured scan home", async () => {
+    // The shared test setup pins the emulated runtime, which also keeps the scan simulated.
+    vi.stubEnv("AGENT_RUNTIME", "");
+    vi.stubEnv("SANDBOX_PROVIDER", "");
+    const scanHome = await scanHomeWithOneFile();
+
+    const asMember = await startOnboardingScan({ actor: member, scanHome }, {});
+    const memberStatus = await completed(asMember.scanId, member.userId);
+    expect(memberStatus.result).toMatchObject({ fileSummary: { totalFiles: 0 } });
+
+    const asOwner = await startOnboardingScan({ actor: owner, scanHome }, {});
+    const ownerStatus = await completed(asOwner.scanId, owner.userId);
+    expect(ownerStatus.status).toBe("complete");
+    expect(ownerStatus.result).toMatchObject({ fileSummary: { totalFiles: 1 } });
+  });
+});

apps/api/src/onboarding-scan.ts

@@ -3,6 +3,7 @@
 import { spawn } from "node:child_process";
 import { access, readdir, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import type { Actor } from "@rakazo/contracts";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -62,6 +63,7 @@ interface CreatedProject {
 interface ScanRecord {
   id: string;
   botId: string;
+  ownerUserId: string;
   status: "scanning" | "connecting" | "building" | "briefing" | "complete" | "failed";
   progress: number;
   message: string;
@@ -113,14 +115,22 @@ async function runSimulatedScan(record: ScanRecord) {
   record.completedAt = new Date();
 }
 
+export interface OnboardingScanRequest {
+  actor: Pick<Actor, "userId" | "isDeploymentOwner">;
+  botId?: string;
+  /** Home-style directory to discover. Unset keeps the scan off the host filesystem. */
+  scanHome?: string;
+}
+
 export async function startOnboardingScan(
-  botId: string | undefined,
+  { actor, botId, scanHome }: OnboardingScanRequest,
   prisma: any,
 ): Promise<{ scanId: string }> {
   const scanId = `scan_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
   const record: ScanRecord = {
     id: scanId,
     botId: botId ?? "",
+    ownerUserId: actor.userId,
     status: "scanning",
     progress: 0,
     message: "Scanning your computer...",
@@ -133,12 +143,18 @@ export async function startOnboardingScan(
   // Run async
   void (async () => {
     try {
-      if (process.env.AGENT_RUNTIME === "scripted" || process.env.SANDBOX_PROVIDER === "fake") {
+      // The host is the deployment owner's machine: only their onboarding may discover it, and
+      // only inside the directory the deployment explicitly configured.
+      if (
+        !scanHome ||
+        !actor.isDeploymentOwner ||
+        process.env.AGENT_RUNTIME === "scripted" ||
+        process.env.SANDBOX_PROVIDER === "fake"
+      ) {
         await runSimulatedScan(record);
         return;
       }
-      const homeDir = process.env.HOME ?? "/home/cynar";
+      const result = await executeFullScan(scanHome, botId ?? "", prisma);
-      const result = await executeFullScan(homeDir, botId ?? "", prisma);
       record.status = "complete";
       record.progress = 100;
       record.message = "Scan complete — profile ready";
@@ -154,14 +170,17 @@ export async function startOnboardingScan(
   return { scanId };
 }
 
-export async function getScanStatus(scanId: string): Promise<{
+export async function getScanStatus(
+  scanId: string,
+  userId: string,
+): Promise<{
   status: ScanRecord["status"];
   progress: number;
   message: string;
   result?: unknown;
 }> {
   const record = scanRegistry.get(scanId);
-  if (!record) throw new Error("Scan not found");
+  if (!record || record.ownerUserId !== userId) throw new Error("Scan not found");
   const result = record.result ? JSON.parse(record.result) : undefined;
   return { status: record.status, progress: record.progress, message: record.message, result };
 }

apps/api/src/router.ts

@@ -453,6 +453,7 @@ export interface RouterDeps {
     agentRuntime: string;
     teamChatJudgeProvider?: string;
     teamChatJudgeModel?: string;
+    onboardingScanHome?: string;
     defaultProvider: string;
     defaultModel: string;
     deploymentModelKey?: string;
@@ -3318,11 +3319,14 @@ export function createRouter(deps: RouterDeps) {
         return { ok: true as const };
       }),
       scan: authed.onboarding.scan.handler(async ({ context, input }) => {
-        const { scanId } = await startOnboardingScan(input.botId, deps.prisma);
+        const { scanId } = await startOnboardingScan(
+          { actor: context.actor, botId: input.botId, scanHome: deps.env.onboardingScanHome },
+          deps.prisma,
+        );
         return { scanId };
       }),
-      scanStatus: authed.onboarding.scanStatus.handler(async ({ input }) => {
+      scanStatus: authed.onboarding.scanStatus.handler(async ({ context, input }) => {
-        return await getScanStatus(input.scanId);
+        return await getScanStatus(input.scanId, context.actor.userId);
       }),
     },
     integrationSetup: {