159/S2 — Per-boot server password for the fork's route auth

[kateebonner]

Important

Problem

The fork server's route auth is verifiably a no-op without a server password — any localhost page can drive the amicode routes (ADR 0002, graft 1).

Approach

The extension mints a cryptographically random per-boot server password and injects it into the opencode server spawn env; the app's existing authenticated-fetch path carries it. Never persisted, never logged. Code lands in the amicode extension.

---

Acceptance Criteria

1. The spawn env includes the password variable with a fresh random value per activation — the test asserts exactly the keys the extension adds (the server inherits the host env by platform design; that inheritance is out of scope).
2. With the password set, an unauthenticated request to an amicode route is rejected (asserted against the fork's auth-layer contract).
3. The password value appears in no output channel or log line (scan test).
4. A restart mints a different value.

Testing Decisions

Extend the existing extension spawn/config-injection tests (the boot-smoke suite stays scope-pure per the parent). New tests only for the mint + added-env assertion.

Key Decisions

• Per-boot random, in-memory only; no file, no setting.

Source

Part of #159 · ADR 0002 graft 1 (PR #158) · Blocked by: none · Lands in: amicode extension

[kateebonner]

Merged into the #159 integration branch (frontier 1); extension suite green (634 passed). Per-boot password armed at every spawn; all extension→server calls authenticated.