security: hardening pass 1 (token scoping, sandbox credential isolation, path-traversal guard)

[pelazas]

First batch of fixes from the audit in docs/SECURITY_THREAT_MODEL.md. Scope was deliberately limited to self-contained application-code changes — no CDK/IAM/network redesign, no UX-affecting changes — so this can land safely and fast. The larger architectural items are listed under Deferred below for follow-up PRs.

What's in this PR

F-3 — Scope the GitHub installation token (main.py)

_get_installation_token sent no request body, so GitHub minted a token covering every repo in the installation with the App's full permission set. Now scoped to the single PR repository and the four permissions RenderPR uses: contents:write (clone + apply push), pull_requests:write (diff/metadata), issues:write (review comment), metadata:read. A leaked token can no longer reach other repos or capabilities.

F-1 (defense-in-depth) — Keep task-role credentials out of untrusted PR processes (main.py)

Dependency install (postinstall hooks) and the dev server run arbitrary PR code, yet inherited the full container environment, including the ECS task-role credential pointers (AWS_CONTAINER_CREDENTIALS_*). That let malicious PR code assume the task role and read every secret in SSM (GitHub App private key, OpenRouter key, all tenants' secrets). Both the install and dev-server subprocesses now launch with a credential-stripped environment (_untrusted_subprocess_env). The agent process keeps its own credentials for S3 upload / task registration.

Note: this is defense-in-depth, not a substitute for removing the role + egress from the runner (see Deferred). It raises the bar significantly because Fargate exposes task-role creds only via the relative-URI pointer we now strip.

F-4 — Stop leaking the command token into the dev server (main.py)

RENDERPR_COMMAND_TOKEN was written to os.environ, which the untrusted dev server inherited. It's now held in a local and passed straight to CommandServer(token=...).

F-11 — Reject path traversal in LLM-driven file access (code_edit.py, editor.py)

Edit file paths come from the LLM (attacker-influenced via the request/diff) and were joined onto REPO_DIR with no guard. New safe_repo_path() resolves under REPO_DIR and rejects ../absolute escapes; validate_edit, apply_edit, apply_edits, request_edit, and find_occurrence_in_file all route through it.

Testing

• Full suite: 465 passed locally (Python 3.12 venv, playwright installed).
• New tests: token scoping (repo + min perms; omits repositories when repo unknown), _untrusted_subprocess_env stripping + overlay precedence, path-traversal/absolute-path rejection for both validate_edit and apply_edit.
• ruff clean on changed files; mypy clean on changed source (pre-existing routes.py errors untouched).

⚠️ Deploy validation needed before merge

contents/pull_requests/issues/metadata are the permissions the bot already relies on, so a correctly-installed App should mint the scoped token fine — but if the installed GitHub App is missing one of these grants, token minting will start returning 422 and reviews will break. Please confirm against a live PR review (waiting for any stale task to STOP first) before merging.

Deferred to follow-up PRs (need infra / product decisions)

• F-1 (full): split untrusted execution into a role-less runner task; mint the scoped token in a trusted stage; hand the runner a pre-signed S3 upload URL so it needs no IAM. Removes the GitHub App private key and OpenRouter key from the sandbox entirely.
• F-2: scope the SSM secrets policy per-repo instead of /renderpr/secrets/*.
• F-5: restrict task egress (currently allowAllOutbound).
• F-6: privatize the screenshot bucket + pre-signed URLs.
• F-7/F-8/F-9/F-10: command channel off the public internet, trigger authorization + quotas, webhook replay protection, CI OIDC.

See docs/SECURITY_THREAT_MODEL.md for the full analysis and prioritized roadmap.

🤖 Generated with Claude Code