925a71887d
Four findings from security audit (internal/security/credential-token-backlog.md):
1. STDERR LEAK — molecule-git-token-helper.sh:146,153 logged ${response}
on platform errors. The response body MAY contain the token in some
failure modes (alternate JSON key shape on partial success). Now:
- capture curl's stderr to a tmp file (not $response) so we can log
the curl error message without ever interpolating the response body
- on empty-token branch, log only response size (bytes) for debug
2. CHMOD 600 — already in place at lines 116, 124, 223 (verified, no change)
3. RESPAWN SUPERVISION — entrypoint.sh wrapped daemon launch in a
while-true bash loop with 30s back-off. Without this, a daemon crash
silently leaves the workspace stuck on an expired token until the
container restarts. Logs to /home/agent/.gh-token-refresh.log
(agent-writable; /var/log is root-owned).
4. JITTER — molecule-gh-token-refresh.sh: added 0..120s random offset to
each sleep so 39 containers don't synchronize their refresh requests
against the platform endpoint.
Also:
- Daemon now sends helper output to /dev/null instead of merging stderr,
belt-and-suspenders against any future helper change that might write
the token to stdout.
- Daemon log lines include rc=$? on failure for actionable triage.
Inherent risks (org-wide token blast, prompt-injection theft, bearer
in volume, no audit log) tracked in internal/security/credential-token-backlog.md
as separate roadmap items.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: molecule-ai[bot] <276602405+molecule-ai[bot]@users.noreply.github.com>
58 lines
2.0 KiB
Bash
Executable File
58 lines
2.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# molecule-gh-token-refresh.sh — background daemon that keeps GitHub
|
|
# credentials fresh inside Molecule AI workspace containers.
|
|
#
|
|
# Started by entrypoint.sh under a respawn wrapper. Every
|
|
# REFRESH_INTERVAL_SEC + jitter (default 45 min ± 2 min) it calls the
|
|
# credential helper's _refresh_gh action.
|
|
#
|
|
# # Jitter
|
|
# A 0..120s random offset prevents 39 containers from synchronizing
|
|
# their refresh requests against /workspaces/:id/github-installation-token.
|
|
#
|
|
# # Security
|
|
# - This daemon NEVER prints token values. Failures log the helper's
|
|
# exit code only, not its stderr, so token bytes can't leak via the
|
|
# docker log pipeline.
|
|
# - The helper script is responsible for chmod 600 on cache files.
|
|
#
|
|
set -uo pipefail
|
|
|
|
HELPER_SCRIPT="${TOKEN_HELPER_SCRIPT:-/app/scripts/molecule-git-token-helper.sh}"
|
|
REFRESH_INTERVAL_SEC="${TOKEN_REFRESH_INTERVAL_SEC:-2700}" # 45 min
|
|
JITTER_MAX_SEC="${TOKEN_REFRESH_JITTER_SEC:-120}"
|
|
INITIAL_DELAY_SEC="${TOKEN_REFRESH_INITIAL_DELAY_SEC:-60}"
|
|
|
|
log() {
|
|
echo "[molecule-gh-token-refresh] $(date -u '+%Y-%m-%dT%H:%M:%SZ') $*" >&2
|
|
}
|
|
|
|
jittered_sleep() {
|
|
local base="$1"
|
|
local jitter=$((RANDOM % (JITTER_MAX_SEC + 1)))
|
|
sleep $((base + jitter))
|
|
}
|
|
|
|
log "starting (interval=${REFRESH_INTERVAL_SEC}s ± ${JITTER_MAX_SEC}s, initial_delay=${INITIAL_DELAY_SEC}s)"
|
|
sleep "${INITIAL_DELAY_SEC}"
|
|
|
|
# Initial refresh — prime the cache + gh auth immediately after boot.
|
|
# Discard helper output to /dev/null so token can't leak via docker logs.
|
|
log "initial token refresh"
|
|
if bash "${HELPER_SCRIPT}" _refresh_gh >/dev/null 2>&1; then
|
|
log "initial refresh succeeded"
|
|
else
|
|
log "initial refresh failed (rc=$?) — will retry in ~${REFRESH_INTERVAL_SEC}s"
|
|
fi
|
|
|
|
# Steady-state loop.
|
|
while true; do
|
|
jittered_sleep "${REFRESH_INTERVAL_SEC}"
|
|
log "periodic token refresh"
|
|
if bash "${HELPER_SCRIPT}" _refresh_gh >/dev/null 2>&1; then
|
|
log "refresh succeeded"
|
|
else
|
|
log "refresh failed (rc=$?) — will retry in ~${REFRESH_INTERVAL_SEC}s"
|
|
fi
|
|
done
|