Prepare ForgeFlow for public release

src/main/config-store.cjs

@@ -4,7 +4,7 @@ const fs = require('node:fs/promises');
 const path = require('node:path');
 const crypto = require('node:crypto');
 const { safeStorage } = require('electron');
-const { assertHttpUrl, assertWorkflowFileName, assertBranchName, assertEnvironmentName, assertCloneRemote, assertRepositoryRelativePath, assertRepositoryRelativePaths } = require('../shared/validation.cjs');
+const { normalizeBaseUrl, assertHttpUrl, assertWorkflowFileName, assertBranchName, assertEnvironmentName, assertCloneRemote, assertRepositoryRelativePath, assertRepositoryRelativePaths } = require('../shared/validation.cjs');
 
 const DEFAULT_CONFIG = {
   schemaVersion: 13,
@@ -266,7 +266,16 @@ class ConfigStore {
     const basePath = String(source.basePath || existing?.basePath || '/mnt/user/appdata').trim().replace(/\/+$/, '');
     if (!basePath.startsWith('/') || /[\r\n\0]/.test(basePath)) throw new Error('The server base path must be an absolute Unix path.');
     const privateKeyPath = String(source.privateKeyPath || existing?.privateKeyPath || '').trim();
-    const hostFingerprint = String(source.hostFingerprint || existing?.hostFingerprint || '').trim();
+    const credentialIdentityChanged = Boolean(existing && [
+      ['host', existing.host, host],
+      ['port', existing.port, port],
+      ['username', existing.username, username],
+      ['authType', existing.authType, authType],
+      ['privateKeyPath', existing.privateKeyPath, privateKeyPath]
+    ].some(([, previous, next]) => String(previous || '') !== String(next || '')));
+    const hostFingerprint = credentialIdentityChanged
+      ? ''
+      : String(source.hostFingerprint || existing?.hostFingerprint || '').trim();
     const scanRoots = uniqueStrings(source.scanRoots || existing?.scanRoots || [basePath]).map((value) => value.replace(/\/+$/, '')).filter((value) => value.startsWith('/') && !/[\r\n\0]/.test(value));
     const scanExcludes = uniqueStrings(source.scanExcludes || existing?.scanExcludes || ['backups', 'archives', 'releases', 'staging', 'testdata']).filter((value) => /^[a-zA-Z0-9._*-]+$/.test(value));
     return {
@@ -281,8 +290,8 @@ class ConfigStore {
       scanExcludes,
       privateKeyPath,
       hostFingerprint,
-      encryptedPassword: existing?.encryptedPassword || null,
-      encryptedPassphrase: existing?.encryptedPassphrase || null,
+      encryptedPassword: credentialIdentityChanged ? null : existing?.encryptedPassword || null,
+      encryptedPassphrase: credentialIdentityChanged ? null : existing?.encryptedPassphrase || null,
       createdAt: existing?.createdAt || new Date().toISOString(),
       updatedAt: new Date().toISOString()
     };
@@ -385,10 +394,19 @@ class ConfigStore {
   }
 
   async updateGitea({ baseUrl, token, user }) {
+    const nextBaseUrl = normalizeBaseUrl(baseUrl);
+    const currentBaseUrl = this.data.gitea.baseUrl
+      ? normalizeBaseUrl(this.data.gitea.baseUrl)
+      : '';
+    if (!String(token || '').trim() && nextBaseUrl !== currentBaseUrl && this.getToken()) {
+      const error = new Error('Enter a new Gitea token when changing the server address.');
+      error.code = 'GITEA_TOKEN_ORIGIN_CHANGED';
+      throw error;
+    }
     const tokenState = this.setToken(token, { preserveExisting: true });
     this.data.gitea = {
       ...this.data.gitea,
-      baseUrl,
+      baseUrl: nextBaseUrl,
       user: user || this.data.gitea.user,
       encryptedToken: this.data.gitea.encryptedToken
     };

src/main/diagnostics-service.cjs

@@ -5,7 +5,7 @@ const path = require('node:path');
 const os = require('node:os');
 const crypto = require('node:crypto');
 const { createZip } = require('../shared/zip-writer.cjs');
-const { sanitizeForDiagnostics, redactSecrets } = require('./log-redaction.cjs');
+const { sanitizeForDiagnostics } = require('./log-redaction.cjs');
 
 const LEVELS = { debug: 10, info: 20, warning: 30, error: 40 };
 
@@ -202,7 +202,7 @@ class DiagnosticsService {
     return this.getStatus();
   }
 
-  async collectLogs(maxBytes = 20 * 1024 * 1024) {
+  async collectLogs(maxBytes = 20 * 1024 * 1024, { strictIdentifiers = false } = {}) {
     await this.flush();
     const output = [];
     let used = 0;
@@ -211,7 +211,16 @@ class DiagnosticsService {
       const remaining = maxBytes - used;
       const content = await fs.readFile(file.path);
       const slice = content.length > remaining ? content.subarray(content.length - remaining) : content;
-      output.push({ name: `logs/${file.name}`, data: Buffer.from(redactSecrets(slice.toString('utf8'), this.secretProvider?.() || []), 'utf8') });
+      output.push({
+        name: `logs/${file.name}`,
+        data: Buffer.from(
+          sanitizeForDiagnostics(slice.toString('utf8'), {
+            secrets: this.secretProvider?.() || [],
+            strictIdentifiers,
+          }),
+          'utf8',
+        ),
+      });
       used += slice.length;
     }
     return output;
@@ -345,7 +354,7 @@ class DiagnosticsService {
       { name: 'operations-sanitized.json', data: safeJson(sanitizedOperations) },
       { name: 'preflight.json', data: safeJson(sanitize(preflight || {})) },
       { name: 'context.json', data: safeJson(sanitize(extra || {})) },
-      ...(await this.collectLogs())
+      ...(await this.collectLogs(20 * 1024 * 1024, { strictIdentifiers: strict }))
     ];
 
     const safetyAudit = auditBundleEntries(entries, this.secretProvider?.() || []);

src/main/external-tools-service.cjs

@@ -3,13 +3,26 @@
 const { spawn } = require('node:child_process');
 const path = require('node:path');
 
-function normalizeTool(tool, defaults) {
+const TOOL_PROFILES = Object.freeze({
+  editor: Object.freeze({
+    code: ['--reuse-window', '--goto', '{file}:{line}'],
+    'code.exe': ['--reuse-window', '--goto', '{file}:{line}'],
+    codium: ['--reuse-window', '--goto', '{file}:{line}'],
+    'codium.exe': ['--reuse-window', '--goto', '{file}:{line}'],
+  }),
+  terminal: Object.freeze({
+    wt: ['-d', '{path}'],
+    'wt.exe': ['-d', '{path}'],
+  }),
+});
+
+function normalizeTool(tool, defaults, kind) {
   const source = tool && typeof tool === 'object' ? tool : {};
   const executable = String(source.executable || defaults.executable).trim();
   if (!executable || /[\r\n\0]/.test(executable)) throw new Error('Tool executable is invalid.');
-  const args = (Array.isArray(source.args) ? source.args : defaults.args).map((item) => String(item)).slice(0, 20);
-  if (args.some((item) => /[\r\n\0]/.test(item))) throw new Error('Tool argument is invalid.');
-  return { executable, args };
+  const profile = TOOL_PROFILES[kind]?.[executable.toLowerCase()];
+  if (!profile) throw new Error(`Unsupported ${kind || 'external'} tool. Select a built-in trusted tool profile.`);
+  return { executable, args: [...profile] };
 }
 
 function expandTool(tool, context) {
@@ -27,7 +40,7 @@ class ExternalToolsService {
     const defaults = kind === 'terminal'
       ? { executable: 'wt.exe', args: ['-d', '{path}'] }
       : { executable: 'code', args: ['--reuse-window', '--goto', '{file}:{line}'] };
-    const configured = normalizeTool(this.store.data.preferences?.[kind], defaults);
+    const configured = normalizeTool(this.store.data.preferences?.[kind], defaults, kind);
     const invocation = expandTool(configured, { path: root, file: candidate, line });
     const child = spawn(invocation.executable, invocation.args, { cwd: root, detached: true, stdio: 'ignore', windowsHide: false, shell: false });
     child.unref();
@@ -35,4 +48,4 @@ class ExternalToolsService {
   }
 }
 
-module.exports = { ExternalToolsService, normalizeTool, expandTool };
+module.exports = { ExternalToolsService, normalizeTool, expandTool, TOOL_PROFILES };

src/main/ipc.cjs

@@ -20,6 +20,7 @@ const {
   readEncryptedBackup,
 } = require("./configuration-backup.cjs");
 const { evaluateDeploymentPolicy } = require("../shared/deployment-policy.cjs");
+const { normalizeBaseUrl } = require("../shared/validation.cjs");
 function registerIpc({
   store,
   git,
@@ -253,8 +254,23 @@ function registerIpc({
   });
 
   register("settings:update-gitea", async ({ baseUrl, token }) => {
-    const effectiveToken = String(token || "").trim() || store.getToken();
-    const validation = await gitea.validateConnection(baseUrl, effectiveToken);
+    const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+    const currentBaseUrl = store.data.gitea.baseUrl
+      ? normalizeBaseUrl(store.data.gitea.baseUrl)
+      : "";
+    const submittedToken = String(token || "").trim();
+    if (!submittedToken && normalizedBaseUrl !== currentBaseUrl) {
+      const error = new Error(
+        "Enter a new Gitea token when changing the server address. Stored tokens are bound to their original origin.",
+      );
+      error.code = "GITEA_TOKEN_ORIGIN_CHANGED";
+      throw error;
+    }
+    const effectiveToken = submittedToken || store.getToken();
+    const validation = await gitea.validateConnection(
+      normalizedBaseUrl,
+      effectiveToken,
+    );
     const tokenState = await store.updateGitea({
       baseUrl: validation.baseUrl,
       token,

src/main/ipc/deployment-handlers.cjs

@@ -96,7 +96,6 @@ function registerDeploymentIpc({
       });
     },
   );
-  register("deployment:health", ({ url }) => deployments.checkHealth(url));
   register("deployment:link-server-workload", async ({ repository, serverId, workloadId, deploymentMode = "server-git", remoteFolder = "" }) => {
     const current = await resolveRepository(repository);
     const result = await unraid.linkServerWorkload({

src/main/log-redaction.cjs

@@ -49,6 +49,13 @@ function stableAlias(value, prefix = 'item') {
   return `${prefix}-${hash}`;
 }
 
+function redactPrivateInfrastructure(value) {
+  return String(value ?? '')
+    .replace(/\b(?:10(?:\.\d{1,3}){3}|127(?:\.\d{1,3}){3}|169\.254(?:\.\d{1,3}){2}|172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2}|192\.168(?:\.\d{1,3}){2})\b/g, '<PRIVATE_ADDRESS>')
+    .replace(/\b(?:https?|ssh):\/\/[^\s"'<>]+/gi, '<PRIVATE_URL>')
+    .replace(/\/(?:mnt|srv|opt|var\/lib)\/[^\s"'<>]*/g, '<SERVER_PATH>');
+}
+
 function sanitizeForDiagnostics(value, options = {}, seen = new WeakSet()) {
   const {
     secrets = [],
@@ -63,6 +70,7 @@ function sanitizeForDiagnostics(value, options = {}, seen = new WeakSet()) {
   if (typeof value === 'string') {
     let output = redactSecrets(value, secrets);
     if (pathMode === 'alias') output = pathAlias(output, { homeDir, cwd });
+    if (strictIdentifiers) output = redactPrivateInfrastructure(output);
     return output;
   }
   if (value instanceof Error) {
@@ -80,7 +88,7 @@ function sanitizeForDiagnostics(value, options = {}, seen = new WeakSet()) {
       output[key] = '[REDACTED]';
       continue;
     }
-    if (strictIdentifiers && ['fullName', 'repository', 'owner', 'user', 'login', 'email'].includes(key)) {
+    if (strictIdentifiers && ['full_name', 'repository', 'owner', 'user', 'login', 'email', 'host', 'hostname', 'username', 'base_path', 'private_key_path', 'local_path', 'remote_folder', 'remote_url', 'clone_url', 'status_url', 'healthcheck_url', 'web_ui_url', 'workspace_roots', 'scan_roots'].includes(normalizedKey.toLowerCase())) {
       output[key] = stableAlias(typeof item === 'object' ? JSON.stringify(item) : item, key.toLowerCase());
       continue;
     }
@@ -90,4 +98,4 @@ function sanitizeForDiagnostics(value, options = {}, seen = new WeakSet()) {
   return output;
 }
 
-module.exports = { redactSecrets, sanitizeForDiagnostics, pathAlias, stableAlias, SENSITIVE_KEY };
+module.exports = { redactSecrets, sanitizeForDiagnostics, pathAlias, stableAlias, redactPrivateInfrastructure, SENSITIVE_KEY };

src/main/update-service.cjs

@@ -97,6 +97,12 @@ function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+function requireSignedSourceUpdate(message) {
+  const error = new Error(message);
+  error.code = "SIGNED_SOURCE_UPDATE_REQUIRED";
+  throw error;
+}
+
 function resolveWindowsPowerShellPath(environment = process.env) {
   const windowsRoot = environment.SystemRoot || environment.WINDIR;
   if (windowsRoot) {
@@ -325,6 +331,11 @@ class UpdateService {
       return this.downloadPackaged(update);
     }
 
+    requireSignedSourceUpdate(
+      "Integrated source updates are disabled because source archives do not yet carry an independently signed publisher manifest. Update a source checkout with Git after reviewing the exact commit.",
+    );
+
+    /* c8 ignore start -- retained for a future signed source-archive implementation */
     await fs.mkdir(this.updateDirectory, { recursive: true });
     const archiveUrl = `${this.store.data.gitea.baseUrl.replace(/\/+$/, "")}/${encodeURIComponent(update.owner)}/${encodeURIComponent(update.repo)}/archive/${update.remoteSha}.zip`;
     const archive = await this.gitea.downloadAuthenticated(archiveUrl);
@@ -354,6 +365,7 @@ class UpdateService {
       sha256,
     });
     return { ...metadata, downloaded: true };
+    /* c8 ignore stop */
   }
 
   async downloadPackaged(update) {
@@ -528,6 +540,10 @@ class UpdateService {
         "The integrated updater currently supports Windows only.",
       );
     if (update.kind === "binary") return this.applyPackaged(update);
+    requireSignedSourceUpdate(
+      "This source archive cannot be applied because it has no independently signed publisher manifest.",
+    );
+    /* c8 ignore start -- legacy helper retained only for migration compatibility */
     const stat = await fs.stat(update.archivePath).catch(() => null);
     if (!stat?.isFile())
       throw new Error("The staged update archive is no longer available.");
@@ -662,6 +678,7 @@ class UpdateService {
       logPath,
       statusPath,
     };
+    /* c8 ignore stop */
   }
 
   async applyPackaged(update) {
@@ -850,4 +867,5 @@ module.exports = {
   waitForUpdaterStarted,
   readJsonFile,
   readLogTail,
+  requireSignedSourceUpdate,
 };