fix(bundles): the install security check reads what Compose applies, on every compose-up path; our own bundles pass it

[kh0pper]

Known gaps (read first)

• Denylist and list mismatches.
  • The install-time text check and the model check don't agree everywhere. The text check refuses a literal ~/.crow/data/<id> mount that the model check would allow; that is stricter, not a hole.
  • The consent dialog's capability summary (summarizePrivileges) is still built from text patterns. It does not list every grant the model check gates (devices, ipc/pid/userns, security_opt, volumes_from).
• Cross-bundle access. This PR closes another bundle's project, volume and network names, its folders, and data-folder or CROW_HOME names. A bundle can still reach another bundle's data through a host path outside Crow's home that both point at (e.g. a shared /srv folder). That is the denylist-vs-allowlist follow-up below.
• Check vs up race. Nothing locks the Start check to compose up, so a peer Configure write could land between them.
• Unreviewed commits. The last commits (data-folder and project-name rules, PATH and git-checkout paths, COMPOSE_PROJECT_NAME) came after the final review round (D). They are covered by tests but have no fresh review.

Why

Queue item 30, fix A (one-click audit). The install security check (validateComposeFile) refused 8 of our own bundles even with consent: gitea, forgejo, frigate, companion, coturn, plex, tailscale and netdata. No test ran it over our own compose files.

Reviewing the fix showed the check only read docker-compose.yml as text, ran only at install, and could be bypassed in many ways. Every one of these exists on main today:

• what the text check misses:
  • YAML anchors and merge keys;
  • JSON-style compose files;
  • interpolated ${VAR} paths;
  • long-syntax mounts;
  • a read-write Docker socket;
  • override files;
  • COMPOSE_FILE in .env;
• no check at all at Start or at the shared-storage re-apply;
• a signed peer could mint a consent token and install;
• the whole gateway environment was passed to Compose, so a compose file could interpolate any gateway secret into a container;
• secret and code paths under the Crow home were mountable.

What changes

• Our bundles pass.
  • /etc/localtime is allowed read-only.
  • companion, coturn, plex and tailscale are marked privileged, with honest en/es consent text; browser and phone get the consent text they lacked.
  • netdata's comment is reworded; gitea and forgejo drop the /etc/timezone mount.
  • nominatim, sdxl and frigate's 8555 bind to 127.0.0.1.
  • vllm uses shm_size instead of ipc: host.
  • companion's optional model folder defaults to a folder inside the bundle.
  • rookery's workspaces folder moves beside its data folder.
• servers/gateway/compose-guard.js checks what Compose will actually run. It runs docker compose config --format json with all profiles, the same working directory, and an allowlisted env, then checks the result against an allowlist: an unknown key or value is refused, and so is a project Compose can't read.
• Host-path policy.
  • Inside Crow's home and the data folder, an allowlist of the bundle's own places, and never a name Crow uses there.
  • Never the bundle's own control files or the files it ships, read-write.
  • Never a bind mount inside another read-write bind mount.
  • Elsewhere refused: system dirs, the gateway checkout, every folder on PATH, any git checkout, home dot-folders and ~/bin, and anything that contains one of these.
  • Symlinks are resolved, dangling ones included.
• Project, volume and network names stay the bundle's own.
• One shared check, checkBundleCompose, runs on install (single and collection), on Start and on the shared-storage re-apply.
• Consent. It is recorded at install. Start takes the trust flags from the reviewed repo manifest, capped by that consent, never from the installed copy. A signed peer can't install, mint consent, uninstall, re-pin or re-apply storage; the path check normalizes case, trailing slashes and doubled slashes.
• composeEnv passes Compose an allowlist of gateway variables; COMPOSE_*/DOCKER_* keys are refused, except COMPOSE_PROJECT_NAME.
• Managed hosting refuses host networking judged from the resolved model.

Accepted behaviour

• Privileged bundles can't be started from a paired instance.

Follow-ups (accepted, queue item 30)

• servers/gateway/gpu-orchestrator.js runs compose up for model bundles outside this check and with the full gateway env.
• The host-path policy outside Crow's home is a denylist. Replacing it with an allowlist needs to tell user-typed values from bundle-shipped ones.
• frigate's live install keeps its old compose file, because a refresh never copies compose files.

Tests

• tests/bundle-compose-gate.test.js runs the real check over every tracked bundle. It covers consent text, all-interface binds and the text-check rules.
• tests/compose-guard.test.js covers the allowlist, path policy, differential cases checked with real docker compose config, every compose-up path, consent, peers, env and names. All bundles are also checked laid out as on a real host.
• Full suite: 9632 tests, 0 failures.

Reviews

• Plan review, code reviews 1 and 2, and security reviews A, B, C and D, all in the private engineering notes.
• D's Important items are fixed with tests, in the post-review commits listed under Known gaps.

Version bumps

browser 1.3.6, companion 1.0.3, coturn 1.0.2, plex 1.0.2, tailscale 1.0.1, frigate 1.0.1, nominatim 1.0.3, sdxl 1.0.1, netdata 1.0.1, gitea 1.0.1, forgejo 1.0.1, phone 0.2.5, vllm 1.0.1, rookery 0.1.2.

Deploy

Gateway code; restart crow-gateway and r4's gateway on the same tree. Merge order: this PR, then #504, then #505, with one restart.

https://claude.ai/code/session_01N9fXzvNy8rCEArj1y5p6fp