chore(security): dep updates, CI hardening, supply chain mitigations

External Socket.dev audit surfaced one critical, one high, and several
moderate CVEs. Combined with the active "mini Shai-Hulud" TanStack npm
supply chain attack (May 2026), tightening the build pipeline and the
dep graph.

Dep updates:
- Direct: uuid 11.1.0 -> 11.1.1 (CVE-2026-41907), dompurify 3.3.3 ->
  3.4.2 (CVE-2026-41238/9/40)
- @anthropic-ai/claude-agent-sdk 0.2.98 -> 0.2.139 (latest)
- Transitive dep overrides for fast-uri ^3.1.2 (CVE-2026-6321, high),
  hono ^4.12.18 (multiple), ip-address ^10.1.1 (CVE-2026-42338) -
  needed because the SDK -> MCP SDK chain pins vulnerable versions.

CI hardening (.github/workflows/ci.yml):
- permissions: { contents: read } at workflow and job level; explicit
  defaults block any over-broad token grants
- npm ci --ignore-scripts blocks postinstall payload execution during
  dependency install; better-sqlite3 is selectively rebuilt for its
  native binding
- npm audit --audit-level=high as a build-blocking step

SECURITY.md extended with:
- Supply chain hardening doc + rationale
- Deferred vulnerabilities table (each with reachability rationale -
  @anthropic-ai/sdk memory tool unused, protobufjs marked unused by
  reachability scanners, postcss dev-only)
- IOC verification commands for users who suspect compromise

Verified clean across 19 personal repos: no spoofed commits
(claude@users.noreply.github.com), no affected packages (@tanstack/*,
@opensearch/*, mistralai, guardrails-ai), no filev2.getsession.org /
tanstack_runner / router_init.js IOC strings in node_modules, no
workflows use pull_request_target or grant id-token:write.

Tests 93/93. Vulnerabilities 8 -> 2 moderate (both documented as
deferred with rationale).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: maryfellowes

.github/workflows/ci.yml

@@ -6,9 +6,19 @@ on:
   push:
     branches: [main]
 
+# Defense against supply chain attacks (e.g. mini Shai-Hulud, 2026-05):
+# default to read-only access. Any job that needs to write must explicitly
+# grant the narrowest scope it requires. Without this, default token
+# permissions are inherited from repo settings and may be over-broad.
+permissions:
+  contents: read
+
 jobs:
   check-and-test:
     runs-on: ubuntu-latest
+    # No id-token, no packages:write, no contents:write — this job only reads.
+    permissions:
+      contents: read
     strategy:
       matrix:
         node-version: [20.x, 22.x]
@@ -20,7 +30,14 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
 
-      - run: npm ci
+      # --ignore-scripts blocks postinstall payloads from executing during
+      # dependency install. We rebuild only the native modules we trust
+      # (better-sqlite3 needs its build script to compile the SQLite binding).
+      - name: Install deps (no scripts)
+        run: npm ci --ignore-scripts
+
+      - name: Rebuild native modules (allowlisted)
+        run: npm rebuild better-sqlite3
 
       - name: Build shared (emits .d.ts for backend/frontend imports)
         run: npm run build --workspace=packages/shared
@@ -33,3 +50,9 @@ jobs:
 
       - name: Test
         run: npm test
+
+      # Audit gate — fails the build on any newly-introduced high or critical
+      # CVE. Moderates and below are tracked but don't block (most are
+      # transitive and waiting on upstream).
+      - name: Audit (block on high or critical)
+        run: npm audit --audit-level=high

SECURITY.md

@@ -4,7 +4,7 @@
 
 | Version | Supported |
 |---------|-----------|
-| v1.x    | Yes       |
+| v2.x    | Yes       |
 
 ## Reporting a vulnerability
 
@@ -24,7 +24,7 @@ Resonant is self-hosted software that runs on your machine:
 - **No cloud backend** — your data stays local (SQLite + filesystem)
 - **No telemetry** — nothing phones home
 - **Auth is optional** — password protection is available but not required for local-only use
-- **Agent SDK queries** go through your Claude Code subscription — we never see them
+- **Agent SDK queries** go through your Claude Code subscription *or* your own Anthropic API key — we never see them
 - **MCP servers** are user-configured — we don't bundle or recommend specific ones
 
 ### What to watch for
@@ -33,3 +33,53 @@ Resonant is self-hosted software that runs on your machine:
 - **CLAUDE.md contents** — this file is sent to the AI on every query. Don't put secrets in it
 - **`.env` and `resonant.yaml`** — contain credentials. Both are gitignored by default
 - **Discord/Telegram tokens** — treat these as secrets. Never commit them
+- **`data/resonant.db`** — when using API-key auth, your Anthropic key sits here in plaintext. Don't commit or share that file. See [docs/AUTH.md](docs/AUTH.md) for the full discussion.
+- **LAN deployments without TLS** — if you run Resonant on a LAN IP without HTTPS, your API key transits in plaintext when first saved. Stay on localhost or use a TLS-terminating reverse proxy.
+
+## Defensive measures in the codebase
+
+- **Helmet + CSP** on all HTTP responses (`frameAncestors 'none'`, narrow `connectSrc`, no eval).
+- **CORS** allowlist constrained to configured origins.
+- **Rate limiting** on `/api` (600/min) and stricter on `/login` (5 per 15 min, skips on success).
+- **Timing-safe password comparison** using `crypto.timingSafeEqual` on a length-padded buffer.
+- **Cryptographic session tokens** (32 random bytes) in `httpOnly` cookies, `sameSite: strict` in production.
+- **Parameterized SQL** throughout. Dynamic UPDATE builders use hardcoded column-name allowlists; no user input ever reaches a column or table name.
+- **No request-body logging** anywhere — API keys and passwords do not appear in logs.
+
+## Supply chain hardening
+
+Resonant's CI workflow (`.github/workflows/ci.yml`) is hardened against npm supply chain attacks (e.g. the "mini Shai-Hulud" TanStack compromise, May 2026):
+
+- **`pull_request` trigger** (not `pull_request_target`). Workflows running on contributor PRs execute in fork context with **no access to repository secrets**.
+- **Minimum `permissions`** declared at workflow and job level. The default is `contents: read` everywhere; no `id-token: write`, no `packages: write`.
+- **`npm ci --ignore-scripts`** disables postinstall payload execution during dependency install. Native modules we depend on are then rebuilt selectively via `npm rebuild better-sqlite3`.
+- **`npm audit --audit-level=high` as a build-blocking step** — any new high or critical CVE entering the dep graph fails the build immediately.
+
+The maintainer manually vets every dependency update against Socket.dev provenance, publish timing, and registry signatures before installing locally.
+
+## Current deferred vulnerabilities
+
+The following are tracked but not yet patched. Each has a rationale.
+
+| Issue | Severity | Status | Why deferred |
+|---|---|---|---|
+| `@anthropic-ai/sdk` (memory tool path escape, file perms) | Moderate | Pinned by `@anthropic-ai/claude-agent-sdk@^0.81.0` | Resonant does not use the memory tool. The CVE is unreachable in our codepath. Will pick up the fix when `@anthropic-ai/claude-agent-sdk` widens its constraint. |
+| `protobufjs <7.5.5` (CVE-2026-41242, arbitrary code exec, CVSS 9.4) | Critical | Transitive via `@huggingface/transformers` → `onnxruntime-web` | Marked "Unused" by reachability scanners — pulled in but never invoked in our load path. Awaiting upstream fix. |
+| `postcss <8.5.10` (CVE-2026-41305) | Moderate | Transitive, dev-only, unused | Build-tool transitive, not in production runtime. |
+
+## How to verify your install isn't compromised
+
+If you suspect compromise (or want to sanity-check after a major dep update):
+
+```bash
+# Should return nothing — known IOC author for the Shai-Hulud family
+git log --all --pretty=format:'%h %ae' --author='claude@users.noreply.github.com'
+
+# Should return nothing — known malicious package families
+grep -rE '"@tanstack|@opensearch|mistralai|guardrails-ai' package.json packages/*/package.json
+
+# Should return nothing — known IOC strings in installed packages
+grep -rE 'filev2.getsession.org|tanstack_runner|router_init.js' node_modules 2>/dev/null
+```
+
+If any of those return hits, treat the install as compromised: rotate every credential the machine could access, wipe `node_modules` and `~/.npm/_cacache`, and reinstall from a known-good lockfile commit.