security: harden terminal WebSocket endpoints against three attack vectors

- Reject node_proxy scoped JWT tokens with 403 on host-console and
  container exec (/ws) upgrades; machine-to-machine credentials must
  not open interactive shells
- Validate stackParam against path.resolve + startsWith(baseDir) to
  prevent directory traversal on the PTY cwd (Rule 9 pattern)
- Strip JWT_SECRET, AUTH_PASSWORD, AUTH_PASSWORD_HASH, DATABASE_URL
  from the environment passed to node-pty spawned shells

backend/src/index.ts

@@ -456,7 +456,11 @@ server.on('upgrade', async (req, socket, head) => {
     const settings = DatabaseService.getInstance().getGlobalSettings();
     const jwtSecret = settings.auth_jwt_secret;
     if (!jwtSecret) throw new Error('No JWT secret');
-    jwt.verify(token, jwtSecret);
+    const decoded = jwt.verify(token, jwtSecret) as { username?: string; scope?: string };
+
+    // Node proxy tokens are machine-to-machine credentials and must never be granted
+    // interactive terminal access (host console or container exec).
+    const isProxyToken = decoded.scope === 'node_proxy';
 
     const url = req.url || '';
     const parsedUrl = new URL(url, `http://${req.headers.host || 'localhost'}`);
@@ -520,15 +524,29 @@ server.on('upgrade', async (req, socket, head) => {
         }
       });
     } else if (hostConsoleMatch) {
+      // Node proxy tokens must not access interactive host terminals
+      if (isProxyToken) {
+        socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+        socket.destroy();
+        return;
+      }
       const hostConsoleWss = new WebSocket.Server({ noServer: true });
       hostConsoleWss.handleUpgrade(req, socket, head, (ws) => {
         hostConsoleWss.close();
         let targetDirectory = '';
         try {
-          targetDirectory = FileSystemService.getInstance(nodeId).getBaseDir();
+          const baseDir = FileSystemService.getInstance(nodeId).getBaseDir();
           const stackParam = parsedUrl.searchParams.get('stack');
           if (stackParam) {
-            targetDirectory = path.join(targetDirectory, stackParam);
+            const resolved = path.resolve(baseDir, stackParam);
+            if (!resolved.startsWith(path.resolve(baseDir))) {
+              ws.send('Error: Invalid stack path\r\n');
+              ws.close();
+              return;
+            }
+            targetDirectory = resolved;
+          } else {
+            targetDirectory = baseDir;
           }
         } catch (e) {
           targetDirectory = FileSystemService.getInstance(NodeRegistry.getInstance().getDefaultNodeId()).getBaseDir();
@@ -544,7 +562,13 @@ server.on('upgrade', async (req, socket, head) => {
         }
       });
     } else {
-      // Generic terminal WebSocket
+      // Generic terminal WebSocket (container exec)
+      // Node proxy tokens must not access interactive container terminals
+      if (isProxyToken) {
+        socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+        socket.destroy();
+        return;
+      }
       wss.handleUpgrade(req, socket, head, (ws) => {
         wss.emit('connection', ws, req);
       });

backend/src/services/HostTerminalService.ts

@@ -16,12 +16,19 @@ export class HostTerminalService {
     static spawnTerminal(ws: WebSocket, targetDirectory: string) {
         const shell = os.platform() === 'win32' ? 'powershell.exe' : getUnixShell();
 
+        // Strip sensitive backend secrets from the PTY environment so they are not
+        // visible to the console user via `env` / `printenv`.
+        const SENSITIVE_KEYS = ['JWT_SECRET', 'AUTH_PASSWORD', 'AUTH_PASSWORD_HASH', 'DATABASE_URL'];
+        const safeEnv = Object.fromEntries(
+            Object.entries(process.env as Record<string, string>).filter(([k]) => !SENSITIVE_KEYS.includes(k))
+        );
+
         const ptyProcess = pty.spawn(shell, [], {
             name: 'xterm-color',
             cols: 80,
             rows: 30,
             cwd: targetDirectory,
-            env: process.env as Record<string, string>,
+            env: safeEnv,
         });
 
         ptyProcess.onData((data) => {